list_splunk_saved_searchesLABSCO SUMMARY
Read-side Splunk, with the context an answer needs.
All five tools are reads — nothing here runs a search or edits a saved object, which makes it safe to point an agent at production. The prompt is the interesting part: it pushes the client to enumerate indexes and macros before interpreting an alert, which is where a Splunk answer usually goes wrong.
What it is
A Go server over the Splunk REST API. Five read tools, plus a prompt that instructs the client to survey alerts, indexes and macros before it answers a question.
What you get
- Saved searches listed, up to 100 at a time with an offset — list_splunk_saved_searches
- Alerts listed and narrowed by a case-insensitive title substring — list_splunk_alerts
- Fired alerts over a look-back window, default -24h, filtered by search name pattern — list_splunk_fired_alerts
- Indexes and macros listed with count and offset — list_splunk_indexes, list_splunk_macros
- A prompt that finds alerts for a keyword such as GitHub or OKTA and tells the client to read alerts, indexes and macros first
- A resource carrying Splunk-related content as extra context
- Both stdio and SSE transports from the same binary
Requirements
SPLUNK_URL pointing at the management port of your instance, https://<YOUR_SPLUNK_INSTANCE>:8089, and SPLUNK_TOKEN. Build with go build, then run the binary directly for stdio or with -transport sse -port 3001 for SSE. A Dockerfile and a smithery.yaml are included for hosted deployment.
Setup effort
Build from source — git clone https://github.com/jkosik/mcp-server-splunk.git
USE CASES
01
Finding out what fired overnight
List fired alerts over a look-back window, narrowed by search name, instead of clicking through the alert history.
02
Understanding an alert you did not write
Read the saved searches and macros behind it, since the macro definitions are usually where the real filter lives.
03
Working out where the data lives
List the indexes with paging, so a question about coverage is answered from the instance rather than from memory.
04
Tracing a keyword across the estate
The bundled prompt takes a term such as GitHub or OKTA and walks the alerts, indexes and macros before answering.
5 tools
Listed in project docs. Your client may show a different list.
list_splunk_alertslist_splunk_fired_alertslist_splunk_indexeslist_splunk_macrosBEFORE YOU INSTALL
What to know first
Tools you get
5 tools named in the project's documentation. Every tool lists Splunk objects; there is no tool for running an ad-hoc SPL search.
Requires
- Go 1.23+
- SPLUNK_URL in your environment
- SPLUNK_TOKEN in your environment
INSTALLATION
Connect your client
This one is built from source rather than installed with a single command.
Server setup
TERMINAL
git clone https://github.com/jkosik/mcp-server-splunk.git
cd mcp-server-splunk
go build -o cmd/mcp-server-splunk/mcp-server-splunk cmd/mcp-server-splunk/main.goMCP Clients
Cursor — stdio
CURSOR — STDIO · JSON
{
"mcpServers": {
"splunk_stdio": {
"name": "Splunk MCP Server",
"description": "Splunk MCP server",
"type": "stdio",
"command": "/tmp/mcp-server-splunk/cmd/mcp-server-splunk/mcp-server-splunk",
"env": {
"SPLUNK_URL": "https://<YOUR_SPLUNKCLOUD>:8089",
"SPLUNK_TOKEN": "<YOUR_SPLUNK_TOKEN>"
}
}
}
}/tmp/mcp-server-splunk is where the README cloned the project; yours is the full path of your clone (the go build step writes the binary to cmd/mcp-server-splunk/mcp-server-splunk; the copy committed to the repository runs only on Apple-silicon Macs). SPLUNK_URL is your Splunk management URL (port 8089) and SPLUNK_TOKEN your Splunk token.
Cursor — SSE
CURSOR — SSE · TERMINAL
cd mcp-server-splunk
export SPLUNK_URL=https://<YOUR_SPLUNK_INSTANCE>:8089
export SPLUNK_TOKEN=<YOUR_SPLUNK_TOKEN>
go run cmd/mcp-server-splunk/main.go -transport sse -port 3001CURSOR — SSE · JSON
{
"mcpServers": {
"splunk_sse": {
"name": "Splunk MCP Server (SSE)",
"description": "MCP server for Splunk integration (SSE mode)",
"type": "sse",
"url": "http://localhost:3001/sse"
}
}
}Keep the server from the steps running; the client then connects to it at http://localhost:3001/sse.
