splunk

The Splunk MCP server is a specialized implementation of the Model Context Protocol designed to facilitate seamless integration with Splunk Enterprise and Splunk Cloud. By leveraging this MCP server, developers can efficiently interact with Cursor IDE or Claude, enabling them to execute complex queries and retrieve contextual data from their Splunk instances effortlessly. This integration empowers you to enhance your data analysis workflows with real-time insights.

Once connected to the Splunk MCP server, you can interact through standard MCP commands to execute queries against your Splunk data. You can utilize tools like Cursor IDE or Claude to formulate and send your queries. The server supports a variety of query types, including searches for specific logs, metrics analysis, and event extraction, making it ideal for developers looking to harness the full power of Splunk's analytics capabilities.

Prerequisites

Before installing the Splunk MCP server, ensure you have Node.js installed on your machine. You can check if Node.js is installed by running:

node -v

Option A: Quick start with npx

If you prefer a quick start without installing it globally, you can use npx. Run the following command:

npx -y livehybrid/splunk-mcp

Option B: Global install alternative

Alternatively, if you want to install it globally, you can clone the repository and install it manually. Use the following commands:

git clone https://github.com/livehybrid/splunk-mcp.git
cd splunk-mcp
npm install

When configuring the Splunk MCP server, ensure that you set the appropriate environment variables for your Splunk instance, such as SPLUNK_HOST, SPLUNK_PORT, and SPLUNK_TOKEN for authentication. A common gotcha is forgetting to set these variables, which can lead to connection issues. Make sure to consult the Splunk documentation for any specific configuration details required for your environment.