How do I install the splunk mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

The recorded environment keys are `SPLUNK_URL`, `SPLUNK_TOKEN`. Keep credentials outside committed files and confirm the configuration required by your installed version.

SSyncDev

Start a project

Splunk MCP Server

A Go implementation of the MCP server for Splunk. Supports STDIO and SSE (Server-Sent Events HTTP API). Uses github.com/mark3labs/mcp-go SDK.

Local serverstdioGo

What is the Splunk MCP Server?

A Go implementation of the MCP server for Splunk. Supports STDIO and SSE (Server-Sent Events HTTP API). Uses github.com/mark3labs/mcp-go SDK.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
list_splunk_saved_searches	Parameters:
count	number, optional): Number of results to return (max 100, default 10)
offset	number, optional): Offset for pagination (default 0)
list_splunk_alerts	Parameters:
title	string, optional): Case-insensitive substring to filter alert titles
list_splunk_fired_alerts	Parameters:
ss_name	string, optional): Search name pattern to filter alerts (default "")
earliest	string, optional): Time range to look back (default "-24h")
list_splunk_indexes	Parameters:
list_splunk_macros	Parameters:

How to install the Splunk MCP Server

{
  "mcpServers": {
    "splunk_sse": {
      "name": "Splunk MCP Server (SSE)",
      "description": "MCP server for Splunk integration (SSE mode)",
      "type": "sse",
      "url": "http://localhost:3001/sse"
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.

Example prompts to try

“Use Splunk to list splunk saved searches.”
“Use Splunk to list splunk alerts.”
“Use Splunk to list splunk fired alerts.”

Frequently asked questions

A Go implementation of the MCP server for Splunk. Supports STDIO and SSE (Server-Sent Events HTTP API). Uses github.com/mark3labs/mcp-go SDK. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.