@mcpcollective/splunk-search

MCP server that runs Splunk searches through Splunk's REST API.

Important usage note

Users should not run this manually in a normal terminal session.

This package is intended to be configured as an MCP server in an AI IDE client (for example Claude Code, GitHub Copilot, Cursor). The client launches the process automatically.

AI IDE MCP configuration

npx @mcpcollective/splunk-search --token <SPLUNK_TOKEN> --url <SPLUNK_BASE_URL>

Equivalent MCP launch config:

{
  "command": "npx",
  "args": [
    "@mcpcollective/splunk-search",
    "--token",
    "YOUR_SPLUNK_TOKEN",
    "--url",
    "https://splunk.example.com:8089"
  ]
}

Client-specific config snippets

Claude Code

{
  "mcpServers": {
    "splunk": {
      "command": "npx",
      "args": [
        "@mcpcollective/splunk-search",
        "--token",
        "YOUR_SPLUNK_TOKEN",
        "--url",
        "https://splunk.example.com:8089"
      ]
    }
  }
}

Cursor

{
  "mcpServers": {
    "splunk": {
      "command": "npx",
      "args": [
        "@mcpcollective/splunk-search",
        "--token",
        "YOUR_SPLUNK_TOKEN",
        "--url",
        "https://splunk.example.com:8089"
      ]
    }
  }
}

GitHub Copilot

{
  "servers": {
    "splunk": {
      "command": "npx",
      "args": [
        "@mcpcollective/splunk-search",
        "--token",
        "YOUR_SPLUNK_TOKEN",
        "--url",
        "https://splunk.example.com:8089"
      ]
    }
  }
}

Arguments:

• --token (required): Splunk authentication token.
• --url (required): Splunk management API base URL, for example https://splunk.example.com:8089.

Exposed MCP tool

• splunk_search
  • query (required, string)
  • earliestTime (optional, string)
  • latestTime (optional, string)
  • count (optional, number): backward-compatible alias for pageSize
  • page (optional, number): 1-based page number
  • pageSize (optional, number): number of results per page
  • offset (optional, number): 0-based offset, overrides page

Pagination behavior:

• If offset is provided, it is used directly.
• Otherwise offset = (page - 1) * pageSize.
• Default page is 1 and default pageSize is 100.