Splunk

What is mcp-server-splunk?

mcp-server-splunk is a Go implementation of an MCP server specifically designed to interact with Splunk. It allows users to programmatically access and manage Splunk data, including saved searches, alerts, indexes, and macros. It supports both STDIO (standard input/output) and SSE (Server-Sent Events HTTP API) communication modes.

How to use mcp-server-splunk?

mcp-server-splunk can be used in two primary modes: STDIO and SSE. Both modes require setting SPLUNK_URL and SPLUNK_TOKEN environment variables for authentication with your Splunk instance.

STDIO Mode

In STDIO mode, you interact with the server via standard input and output. You can send JSON-RPC requests to list available tools or call specific tools. For example, to list tools:

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | go run cmd/mcp-server-splunk/main.go | jq

To call a tool like list_splunk_saved_searches:

echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_splunk_saved_searches","arguments":{}}}' | go run cmd/mcp-server-splunk/main.go | jq

SSE Mode

In SSE mode, the server runs as an HTTP API. You start the server on a specified port, obtain a session ID, and then send JSON-RPC requests via curl to the running server.

export SPLUNK_URL=https://your-splunk-instance:8089
export SPLUNK_TOKEN=your-splunk-token
go run cmd/mcp-server-splunk/main.go -transport sse -port 3001
curl http://localhost:3001/sse # Get Session ID
curl -X POST "http://localhost:3001/message?sessionId=YOUR_SESSION_ID" -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | jq

Docker

You can also build and run mcp-server-splunk using Docker for containerized deployment.

docker build -t mcp-server-splunk .
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | \
docker run --rm -i \
  -e SPLUNK_URL=https://your-splunk-instance:8089 \
  -e SPLUNK_TOKEN=your-splunk-token \
  mcp-server-splunk | jq

Cursor Integration

mcp-server-splunk can be integrated with Cursor by configuring MCP Settings in ~/.cursor/mcp.json. This allows Cursor to leverage the MCP tools, prompts, and resources provided by the server for enhanced AI interactions.

Key Features of mcp-server-splunk

• Splunk Integration: Provides a robust interface to interact with Splunk data and functionalities.
• Tooling for Splunk Data: Offers specific tools to list and manage Splunk saved searches, alerts (including fired alerts), indexes, and macros.
• Flexible Communication: Supports both STDIO for scripting and SSE for persistent HTTP API interactions.
• Pagination and Filtering: Tools include parameters for pagination (count, offset) and filtering (e.g., title for alerts, ss_name for fired alerts, earliest for time range).
• MCP Prompts and Resources: Includes an MCP Prompt to find Splunk alerts based on keywords and an MCP Resource for additional context from a local CSV file.
• Docker Support: Easily deployable via Docker for consistent environments.
• Cursor Integration: Seamlessly integrates with Cursor for AI-powered interactions with Splunk data.

Use Cases of mcp-server-splunk

• Automated Splunk Data Retrieval: Programmatically fetch lists of saved searches, alerts, indexes, and macros for reporting or further processing.
• Alert Monitoring and Analysis: Monitor and analyze fired alerts based on various criteria like search name or time range.
• Integration with AI/LLM Tools: When integrated with Cursor, it enables AI models to query Splunk data and provide intelligent responses based on real-time information.
• Custom Scripting and Automation: Develop custom scripts and automation workflows that interact with Splunk data without direct Splunk UI access.
• Data Exploration: Quickly explore Splunk indexes and macros for understanding the Splunk environment.

FAQ about mcp-server-splunk

• What is MCP? MCP stands for Multi-Cloud Platform. In this context, it refers to a framework or server that allows integration with various services, in this case, Splunk.
• What are the prerequisites to use mcp-server-splunk? You need a running Splunk instance and its URL and an authentication token. Go runtime is required to build and run the server directly, or Docker for containerized deployment.
• Can I filter the results from the tools? Yes, several tools support filtering parameters like title for alerts, ss_name for fired alerts, and earliest for time ranges.
• How do I integrate this with Cursor? You need to update your ~/.cursor/mcp.json file with the configuration details for either STDIO or SSE mode, pointing to your running mcp-server-splunk instance.
• What is the purpose of MCP Prompts and Resources? MCP Prompts guide the AI on how to use the available tools to answer specific questions, while MCP Resources provide additional context or data to the AI model.

MCP Server for Splunk

A Go implementation of the MCP server for Splunk. Supports STDIO and SSE (Server-Sent Events HTTP API). Uses github.com/mark3labs/mcp-go SDK.

MCP Tools implemented

• list_splunk_saved_searches
  • Parameters:
    • count (number, optional): Number of results to return (max 100, default 100)
    • offset (number, optional): Offset for pagination (default 0)
• list_splunk_alerts
  • Parameters:
    • count (number, optional): Number of results to return (max 100, default 10)
    • offset (number, optional): Offset for pagination (default 0)
    • title (string, optional): Case-insensitive substring to filter alert titles
• list_splunk_fired_alerts
  • Parameters:
    • count (number, optional): Number of results to return (max 100, default 10)
    • offset (number, optional): Offset for pagination (default 0)
    • ss_name (string, optional): Search name pattern to filter alerts (default "*")
    • earliest (string, optional): Time range to look back (default "-24h")
• list_splunk_indexes
  • Parameters:
    • count (number, optional): Number of results to return (max 100, default 10)
    • offset (number, optional): Offset for pagination (default 0)
• list_splunk_macros
  • Parameters:
    • count (number, optional): Number of results to return (max 100, default 10)
    • offset (number, optional): Offset for pagination (default 0)

MCP Prompts and Resources

• internal/splunk/prompt.go implements an MCP Prompt to find Splunk alerts for a specific keyword (e.g. GitHub or OKTA) and instructs Cursor to utilise multiple MCP tools to review all Splunk alerts, indexes and macros first to provide the best answer.
• cmd/mcp/server/main.go implements MCP Resource in the form of local CSV file with Splunk related content, providing further context to the chat.

Usage

STDIO mode (default)

export SPLUNK_URL=https://your-splunk-instance:8089
export SPLUNK_TOKEN=your-splunk-token

# List available tools
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | go run cmd/mcp-server-splunk/main.go | jq

# Call list_splunk_saved_searches tool
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_splunk_saved_searches","arguments":{}}}' | go run cmd/mcp-server-splunk/main.go | jq

SSE mode (Server-Sent Events HTTP API)

export SPLUNK_URL=https://your-splunk-instance:8089
export SPLUNK_TOKEN=your-splunk-token

# Start the server
go run cmd/mcp-server-splunk/main.go -transport sse -port 3001

# Call the server and get Session ID from the output. Do not terminate the session.
curl http://localhost:3001/sse

# Keep session running and and use different terminal window for the final MCP call
curl -X POST "http://localhost:3001/message?sessionId=YOUR_SESSION_ID" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | jq

Installing via Smithery

Dockerfile and smithery.yaml are used to support hosting this MCP server at [Smithery](https://smithery.ai/server/@jkosik/.

Local Docker build and run

docker build -t mcp-server-splunk .

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | \
docker run --rm -i \
  -e SPLUNK_URL=https://your-splunk-instance:8089 \
  -e SPLUNK_TOKEN=your-splunk-token \
  mcp-server-splunk | jq

Cursor integration

By configuring MCP Settings in Cursor, you can include remote data directly into the LLM context.

Integrate STDIO or SSE MCP Servers (see below) and use Cursor Chat. Cursor will automatically try to use MCP Tools, Prompts or Re Sample prompts:

• How many MCP tools for Splunk are available?
• How many Splunk indexes do we have?
• Can you list first 5 Splunk macros including underlying queries?
• How many alers with "Alert_CRITICAL" in the name were fired in the last day?
• Read the MCP Resource "Data Dictionary" and find the contact person for the Splunk index XYZ.

STDIO mode

Build the server:

go build -o cmd/mcp-server-splunk/mcp-server-splunk cmd/mcp-server-splunk/main.go

Update ~/.cursor/mcp.json

{
  "mcpServers": {
    "splunk_stdio": {
      "name": "Splunk MCP Server (STDIO)",
      "description": "MCP server for Splunk integration",
      "type": "stdio",
      "command": "/Users/juraj/data/github.com/jkosik/mcp-server-splunk/cmd/mcp-server-splunk/mcp-server-splunk",
      "env": {
        "SPLUNK_URL": "https://your-splunk-instance:8089",
        "SPLUNK_TOKEN": "your-splunk-token"
      }
    }
  }
}

SSE mode

Start the server:

export SPLUNK_URL=https://your-splunk-instance:8089
export SPLUNK_TOKEN=your-splunk-token

# Start the server
go run cmd/mcp-server-splunk/main.go -transport sse -port 3001

Update ~/.cursor/mcp.json

{
  "mcpServers": {
    "splunk_sse": {
      "name": "Splunk MCP Server (SSE)",
      "description": "MCP server for Splunk integration (SSE mode)",
      "type": "sse",
      "url": "http://localhost:3001/sse"
    }
  }
}

Certified by MCP Review: https://mcpreview.com/mcp-servers/jkosik/mcp-server-splunk