@tocharianou/splunk-mcp
v1.0.1
Published
Splunk MCP Server – SPL search execution, index/sourcetype discovery, saved searches, and health checks for security investigations
Maintainers
Readme
splunk-mcp
Splunk MCP Server for security investigations and log analysis.
Tools
| Tool | Description |
|------|-------------|
| search_splunk | Execute SPL queries with time range and field filtering |
| splunk_health_check | Test connection, get server info and installed apps |
| list_indexes | List indexes with event counts, size, and time range |
| get_index_info | Detailed metadata for a specific index |
| get_indexes_and_sourcetypes | Discover active indexes and sourcetypes via tstats |
| list_saved_searches | List saved searches and scheduled alerts |
Configuration
| Variable | Description |
|----------|-------------|
| SPLUNK_HOST | Splunk hostname or IP |
| SPLUNK_PORT | Management port (default: 8089) |
| SPLUNK_SCHEME | https or http (default: https) |
| SPLUNK_USERNAME | Username for basic auth |
| SPLUNK_PASSWORD | Password for basic auth |
| SPLUNK_TOKEN | Bearer token (takes priority over user/pass) |
| SPLUNK_VERIFY_SSL | true/false (default: true) |
| MAX_TOKEN_CALL | Token limit per call (default: 20000) |
