Splunk MCP server: official app vs community project

Which one is the official app, why a repository inside Splunk's own organization says it is not, and what each actually installs into.

Checked 31 August 2026 · from help.splunk.com, Splunkbase, the splunk GitHub organization and the project README

One of 91 guides to monitoring and developer tools. Each covers what an AI coding agent can get out of the tool through MCP, the protocol that lets the agent query the tool directly.

What is the Splunk MCP server?

Splunk is a log and event platform, and its query language is SPL. An MCP server over it lets an agent run searches and read results without a browser.

The official route is a Splunkbase app, which is how Splunk distributes functionality that runs inside a Splunk deployment. It installs into Splunk Enterprise or Splunk Cloud rather than running as a standalone process.

The GitHub project takes the other approach: a server you run yourself that talks to Splunk over its API. Its README describes safety guardrails for SPL input validation and output sanitization, which is the sensible concern when a model writes queries.

Two things are called the Splunk MCP Server:

Both are titled Splunk MCP Server in their own documentation. The distinction is the repository description and the distribution channel, not the name.

Splunk's MCP server is about investigating indexed operational data. A deploy is reachable only where something logs an event for it. Nothing here reviews code, traces an agent or reports spend.

In practice, Splunk answers whatever your logs contain, which is broader than most connectors and less structured. It has no model of a deploy, a service or an incident, so the quality of an answer depends entirely on what your pipeline indexed.

What can an AI agent do with Splunk?

Splunk publishes the tool list in its own product documentation: 33 tools for version 2.0, with 16 prefixed splunk_, 5 prefixed saia_ and 12 prefixed o11y_. The splunk_ family covers search, instance and index metadata, users, KV Store collections, knowledge objects and alerts. The saia_ family is natural-language assistance over SPL rather than access to new data. The o11y_ family reaches Splunk Observability once configured. The core of the connector is Splunk Enterprise and Splunk Cloud search, so a useful question is one a search would answer.

Splunk MCP server limits: where answers come back incomplete

The first limit is a naming collision. A repository in Splunk's own GitHub organization carries the same title as the official Splunkbase app. Check which one you are installing before you follow any setup.

How to configure Splunk MCP for agents

1. 1

   Decide which of the two you mean

   The Splunkbase app installs into Splunk; the GitHub project is a process you run and maintain yourself.

2. 2

   Read the unofficial label before adopting the repository

   It is in Splunk's organization and its description still begins with that word.

3. 3

   Expect SPL to be the interface

   An agent writing SPL is writing a query language, and the GitHub project documents validation guardrails specifically for that.

4. 4

   Scope the Splunk role

   Search permissions in Splunk decide what any MCP route can read, whichever one you choose.

Paste this into your agent’s instructions

An SPL search returns exactly what the index holds, and an empty result can mean the data was never indexed. The block separates the two.

When you answer using Splunk MCP tools, state:
- The SPL you ran and the time range it covered.
- The index or source type you searched. An empty result may
  mean the data was never indexed rather than never happened.
- Which server you used: the Splunkbase app, or the separate
  GitHub project that describes itself as unofficial.
Never state that data does not exist. State that the search
above returned no events.
Write your answer in ASD-STE100 Simplified Technical
English. Use short sentences with one idea in each.

Do you need the MCP server at all?

Not for a report that runs to a schedule. Splunk's REST API and the search endpoints are the direct route there, and they avoid both the app install and the context cost.

The connector earns its place during an investigation, where an agent can write a search, read the result and refine it without leaving the editor.

For application logs where Splunk is not already the destination, OpenSearch and Elastic both publish servers over their own stores.

For metrics rather than logs, Prometheus and Grafana answer a different class of question that Splunk indexes rarely hold in a useful shape.

Use the Splunkbase app for a supported route. Call the REST API for anything scheduled.

Splunk MCP server setup

Splunk's server is a Splunkbase app, which makes its install different from every other connector in this directory. It goes into Splunk, not next to your agent.

That is the prerequisite worth stating first: it needs an existing Splunk Enterprise or Splunk Cloud deployment. There is no standalone process to run without one.

The Splunkbase record lists it as live, licensed under Splunk General Terms, with app id Splunk_MCP_Server at uid 7931.

Nothing below configures Claude Code or Cursor. The app runs inside Splunk rather than beside the agent, and the client-side connection is documented in Splunk's own MCP server reference.

Splunk Web -> Apps -> Manage Apps -> Install app from file
# or unpack into $SPLUNK_HOME/etc/apps

Deployment server / App management -> push Splunk_MCP_Server

Every other client

Each block below is the configuration for one client, with the file path and the key that client expects.

curl -s https://splunkbase.splunk.com/api/v1/app/7931/ \
  | python3 -c "import json,sys; d=json.load(sys.stdin); \
    print(d['title'], d['appid'], d['archive_status'])"

Splunkbase app 7931  ->  installs into Splunk
npm / PyPI           ->  nothing, by design

Read-only access, permissions and security

• SPL is powerful, and a model writes it

  The GitHub project documents input validation for SPL and sanitization of output, which is the right concern for generated queries.

• The Splunk role is the boundary

  Whatever the credentials can search is what an agent can read, and Splunk indexes tend to hold sensitive data.

• Two servers means two review conversations

  The Splunkbase app is reviewed as a Splunk app; the GitHub project is code you adopt yourself.

• Results can be large

  A search over a broad index can return far more than a context window holds, so bounding the search matters more here than on most connectors.

Troubleshooting

You cannot find the server on GitHub

The official route is Splunkbase app 7931, titled Splunk MCP Server. There is an official repository as well, CiscoDevNet/Splunk-MCP-Server-official, though it is a single snapshot: created and pushed within two minutes on 18 February 2026, 4 stars, no license declared.

The GitHub project says it is unofficial

That is accurate and it is in Splunk's own organization. splunk/splunk-mcp-server2 describes itself that way, and was last pushed 16 June 2025.

A search returns nothing

Check the index and the time range before concluding the event did not happen. Splunk returns nothing for an unindexed source in exactly the same way.

A long search is not what `splunk_run_query` is for

Splunk describes it as "intended for quick searches that are deemed safe and non-destructive". It can fail when a search runs past 1 minute or returns more than 1,000 events. Bound the search by index and time range before you run it.

Splunk MCP server: Reference

What engineers report

The two surfaces are the story, so the facts below distinguish them rather than summarizing Splunk.

The Splunkbase listing for app 7931 was fetched on 24 August 2026 and returned HTTP 200 with the title Splunk MCP Server. Repository facts and the README for splunk/splunk-mcp-server2 come from the GitHub API and raw content on the same date. Splunk publishes the tool list in its product documentation: 33 tools for version 2.0, with 16 prefixed splunk_, 5 prefixed saia_ and 12 prefixed o11y_, read from help.splunk.com on 6 October 2026.

Should you connect an agent to Splunk?

Yes. Best for the Splunkbase app, with searches bounded by index and time range.

Strongest fit

Splunk Enterprise or Splunk Cloud customers who want an agent writing searches against indexes they already run.

Main advantage

Search over whatever you have indexed, which is broader than any structured connector in this guide.

Main weakness

Two things share the name, and the more discoverable one describes itself as unofficial.

Operational risk

A model writing SPL against indexes that usually hold sensitive data, bounded only by the Splunk role.

Frequently asked questions