Splunk

by livehybrid

16 stars

Not rated

GitHub

About

Integrates with Splunk Enterprise/Cloud to enable natural language-driven searches, index management, user handling, and KV store operations through a Python-based interface supporting both command-line and web server integration.

Details

Author: livehybrid
Repository: livehybrid/splunk-mcp
GitHub stars: 16
License: Apache License 2.0
Categories: Search, Other, Infrastructure, AI, Design, Developer Tools, Frontend, Cloud Service, Security

- Splunk Search: Execute Splunk searches with natural language queries
- Index Management: List and inspect Splunk indexes
- User Management: View and manage Splunk users
- KV Store Operations: Create, list, and manage KV store collections
- Async Support: Built with async/await patterns for better performance
- Detailed Logging: Comprehensive logging with emoji indicators for better visibility
- SSL Configuration: Flexible SSL verification options for different security requirements
- Enhanced Debugging: Detailed connection and error logging for troubleshooting
- Comprehensive Testing: Unit tests covering all major functionality
- Error Handling: Robust error handling with appropriate status codes
- SSE Compliance: Fully compliant with MCP SSE specification

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below
Plugin Name Splunk

Command (node, npx, python, etc.) npx
Arguments
- Argument 1 -y
- Argument 2 @highlight/mcp-server
Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "/c",
                "npx",
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "cmd"
        }
    }
}

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "/c",
                "npx",
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "cmd"
        }
    }
}

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "/c",
                "npx",
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "cmd"
        }
    }
}

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "/c",
                "npx",
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "cmd"
        }
    }
}

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "/c",
                "npx",
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "cmd"
        }
    }
}

JSON

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

From the repository

1. Clone the repository:

   git clone <repository-url>

   cd splunk-mcp

2. Install dependencies with UV:

uv sync

uv sync --extra dev

3. Run the application:

pip install -r requirements.txt uv sync --extra dev The tool can run in three modes:

1. SSE mode (default for MCP clients):

bash

The project supports both the new docker compose (V2) and legacy docker-compose (V1) commands. The examples below use V2 syntax, but both are supported.

1. SSE Mode (Default):

docker compose up -d mcp

2. API Mode:

docker compose run --rm mcp python splunk_mcp.py api

3. STDIO Mode:

docker compose run -i --rm mcp python splunk_mcp.py stdio

`list_tools`

Lists all available MCP tools with their descriptions and parameters

`health_check`

Returns a list of available Splunk apps to verify connectivity

`ping`

Simple ping endpoint to verify MCP server is alive

`current_user`

Returns information about the currently authenticated user

`list_users`

Returns a list of all users and their roles

`list_indexes`

Returns a list of all accessible Splunk indexes

`get_index_info`

Returns detailed information about a specific index. Parameters: index_name (string)

`indexes_and_sourcetypes`

Returns a comprehensive list of indexes and their sourcetypes

`search_splunk`

Executes a Splunk search query. Parameters: search_query (string), earliest_time (string, optional), latest_time (string, optional), max_results (integer, optional)

`list_saved_searches`

Returns a list of saved searches in the Splunk instance

`list_kvstore_collections`

Lists all KV store collections

`create_kvstore_collection`

Creates a new KV store collection. Parameters: collection_name (string)

`delete_kvstore_collection`

Deletes an existing KV store collection. Parameters: collection_name (string)

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "splunk": {
            "env": {},
            "args": [
                "-y",
                "@highlight/mcp-server"
            ],
            "command": "npx"
        }
    }
}

Linux

{
    "env": [],
    "args": [
        "-y",
        "@highlight/mcp-server"
    ],
    "command": "npx"
}

Macos

{
    "env": [],
    "args": [
        "-y",
        "@highlight/mcp-server"
    ],
    "command": "npx"
}

Windows

{
    "env": [],
    "args": [
        "/c",
        "npx",
        "-y",
        "@highlight/mcp-server"
    ],
    "command": "cmd"
}

Splunk MCP (Model Context Protocol) Tool

A FastMCP-based tool for interacting with Splunk Enterprise/Cloud through natural language. This tool provides a set of capabilities for searching Splunk data, managing KV stores, and accessing Splunk resources through an intuitive interface.

Operating Modes

The tool operates in three modes:

1. SSE Mode (Default)
- Server-Sent Events based communication
- Real-time bidirectional interaction
- Suitable for web-based MCP clients
- Default mode when no arguments provided
- Access via /sse endpoint

2. API Mode
- RESTful API endpoints
- Access via /api/v1 endpoint prefix
- Start with python splunk_mcp.py api

3. STDIO Mode
- Standard input/output based communication
- Compatible with Claude Desktop and other MCP clients
- Ideal for direct integration with AI assistants
- Start with python splunk_mcp.py stdio

Features

Available MCP Tools

The following tools are available via the MCP interface:

Tools Management

- list_tools - Lists all available MCP tools with their descriptions and parameters

Health Check

- health_check - Returns a list of available Splunk apps to verify connectivity - ping - Simple ping endpoint to verify MCP server is alive

User Management

- current_user - Returns information about the currently authenticated user - list_users - Returns a list of all users and their roles

Index Management

- list_indexes - Returns a list of all accessible Splunk indexes - get_index_info - Returns detailed information about a specific index - Parameters: index_name (string) - indexes_and_sourcetypes - Returns a comprehensive list of indexes and their sourcetypes

Search

- search_splunk - Executes a Splunk search query - Parameters: - search_query (string): Splunk search string - earliest_time (string, optional): Start time for search window - latest_time (string, optional): End time for search window - max_results (integer, optional): Maximum number of results to return - list_saved_searches - Returns a list of saved searches in the Splunk instance

KV Store

- list_kvstore_collections - Lists all KV store collections - create_kvstore_collection - Creates a new KV store collection - Parameters: collection_name (string) - delete_kvstore_collection - Deletes an existing KV store collection - Parameters: collection_name (string)

SSE Endpoints

When running in SSE mode, the following endpoints are available:

- /sse: Returns SSE connection information in text/event-stream format
- Provides metadata about the SSE connection
- Includes URL for the messages endpoint
- Provides protocol and capability information

- /sse/messages: The main SSE stream endpoint
- Streams system events like heartbeats
- Maintains persistent connection
- Sends properly formatted SSE events

- /sse/health: Health check endpoint for SSE mode
- Returns status and version information in SSE format

Error Handling

The MCP implementation includes consistent error handling:

- Invalid search commands or malformed requests
- Insufficient permissions
- Resource not found
- Invalid input validation
- Unexpected server errors
- Connection issues with Splunk server

All error responses include a detailed message explaining the error.

Installation

Using UV (Recommended)

UV is a fast Python package installer and resolver, written in Rust. It's significantly faster than pip and provides better dependency resolution.

Prerequisites

- Python 3.10 or higher - UV installed (see UV installation guide)

Quick Start with UV

1. Clone the repository:

   git clone <repository-url>

   cd splunk-mcp

2. Install dependencies with UV:

   # Install main dependencies

   uv sync

   

   # Or install with development dependencies

   uv sync --extra dev

3. Run the application:

   # SSE mode (default)

   uv run python splunk_mcp.py

   

   # STDIO mode

   uv run python splunk_mcp.py stdio

   

   # API mode

   uv run python splunk_mcp.py api

UV Commands Reference

```bash

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

list_tools

health_check

ping

current_user

list_users

list_indexes

get_index_info

indexes_and_sourcetypes

search_splunk

list_saved_searches

list_kvstore_collections

create_kvstore_collection

delete_kvstore_collection

Claude Desktop / Cursor

Linux

Macos

Windows

Splunk MCP (Model Context Protocol) Tool

Operating Modes

Features

Available MCP Tools

Tools Management

Health Check

User Management

Index Management

Search

KV Store

SSE Endpoints

Error Handling

Installation

Using UV (Recommended)

Prerequisites

Quick Start with UV

UV Commands Reference

Install

More like this

Sequential Thinking

Brave Search

Filesystem

EverArt

Google Drive

Reactive Resume

`list_tools`

`health_check`

`ping`

`current_user`

`list_users`

`list_indexes`

`get_index_info`

`indexes_and_sourcetypes`

`search_splunk`

`list_saved_searches`

`list_kvstore_collections`

`create_kvstore_collection`

`delete_kvstore_collection`