search_logs
Search SolarWinds Observability logs with optional filtering
LABSCO SUMMARY
Two tools over one API: read the lines, or see the shape first.
Running the histogram before the search is the cheaper order — bucket by hour, find the ten minutes where the error count jumps, then re-run the same filter with a narrow start and end time instead of paging through a day. Know the boundary before you rely on it: queries are filter strings, and the author notes the server does not support structured-data search.
What it is
A reader for SolarWinds Observability logs. One tool returns matching log entries, the other counts the same query into time buckets so a spike is visible before you read a single line.
What you get
- Log search over a filter string, narrowed by group, entity and an ISO 8601 start and end time, defaulting to the last 24 hours
- Results formatted with timestamps, hostnames and messages, paginated by page size and direction so a long window can be walked in either direction
- A histogram of the same query bucketed by minute, hour or day, in UTC or local time
- Histogram output as an ASCII chart to read in place, or as JSON with time ranges, counts, total and the query parameters, for a client that draws it
Requirements
A SolarWinds Observability API token in SOLARWINDS_API_TOKEN, set in the client config, the environment, or a local .env file. It starts over stdio as npx -y mcp-solarwinds. Searches default to the last 24 hours and a page size of 50. On Windows, a spawn ENOENT on npx is worked around by pointing the command at node.exe and npx-cli.js by full path.
Setup effort
One command plus a key — npm install -g mcp-solarwinds, then supply credentials
USE CASES
01
Finding when an error started
Bucket the same filter by hour or minute across the window and read the counts, so the onset is a number rather than a scroll.
02
Reading the log lines around an incident
Search the filter with an explicit start and end time and page through the results in either direction, with hostnames and timestamps attached.
03
Isolating one host or service
Narrow the same query by entity or group before searching, so a noisy fleet does not bury the one machine you care about.
04
Handing a chart to the client instead of ASCII
Ask for JSON output and the response carries time ranges, counts and totals with the query parameters, ready to be drawn.
2 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
visualize_logs
Generate a histogram visualization of log events
BEFORE YOU INSTALL
What to know first
Tools you get
2 tools when we connected. solarwinds://{query}/search is a resource, not a third tool, and the server does not support structured data search, so don't expect field-level queries.
Requires
- npx on PATH
- SOLARWINDS_API_TOKEN in your environment
Where it runs
All 3 documented clients run the server on your machine.
CONTEXT COST
Light Standing cost
Rated by the size of the 2 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npm install -g mcp-solarwindsMCP Clients
Cline
CLINE · JSON
{
"mcpServers": {
"solarwinds": {
"command": "npx",
"args": [
"-y",
"mcp-solarwinds"
],
"env": {
"SOLARWINDS_API_TOKEN": "<YOUR_SOLARWINDS_API_TOKEN>"
},
"autoApprove": [
"search_logs",
"visualize_logs"
]
}
}
}Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"solarwinds": {
"command": "npx",
"args": [
"-y",
"mcp-solarwinds"
],
"env": {
"SOLARWINDS_API_TOKEN": "<YOUR_SOLARWINDS_API_TOKEN>"
}
}
}
}Any MCP client — Windows
ANY MCP CLIENT — WINDOWS · JSON
{
"mcpServers": {
"solarwinds": {
"command": "C:\\Users\\<YOUR_USERNAME>\\AppData\\Roaming\\nvm\\[node-version]\\node.exe",
"args": [
"C:\\Users\\<YOUR_USERNAME>\\AppData\\Roaming\\npm\\node_modules\\npm\\bin\\npx-cli.js",
"-y",
"mcp-solarwinds"
],
"env": {
"SOLARWINDS_API_TOKEN": "<YOUR_SOLARWINDS_API_TOKEN>"
}
}
}
}
