Install guide and config at curatedmcp.com

Splunk MCP: Let Your AI Agent Query Observability Data and Triage Incidents

Splunk MCP is the official Model Context Protocol server that connects Claude, Cursor, and other AI agents directly to your Splunk instance. Instead of manually digging through dashboards and log searches, your AI can now query observability data, pull alert timelines, correlate security events, and surface root causes from massive datasets—all in natural conversation.

The server acts as a bridge between AI agents and Splunk's data layer. You can ask Claude to search logs across services, inspect metrics and traces, retrieve alert histories, and cross-reference operational events with security incidents. For SRE and SecOps teams, this means faster incident triage and better context gathering without context-switching to the Splunk UI.

What It Does

Splunk MCP unlocks these core capabilities:

• Run Splunk queries and retrieve event results directly from your search head
• Inspect logs, metrics, and traces across distributed services
• Access alert and incident timelines to understand event history
• Search dashboards and saved searches without manual lookups
• Manage Splunk apps and data inputs programmatically
• Correlate security and operational events to find patterns humans might miss

This is especially powerful for incident response. Instead of copying log snippets into chat, Claude can pull relevant events, correlate them with alert data, and suggest root causes—all while staying within the context window of your conversation.

How to Install

Install via npm:

npx -y @splunk/mcp

Add to your Claude Desktop config (claude_desktop_config.json):

{
  "mcpServers": {
    "splunk-mcp": {
      "command": "npx -y @splunk/mcp",
      "env": {
        "SPLUNK_URL": "https://your-splunk-instance:8089",
        "SPLUNK_AUTH_TOKEN": "your-bearer-token"
      }
    }
  }
}

For Cursor and Windsurf setup guides, check the full documentation at CuratedMCP.

Real-World Use Cases

• Incident triage in real time: Ask Claude to search for error spikes in your logs, then have it correlate those errors with triggered alerts and recent deployments to identify the root cause.
• Cross-service debugging: When a user reports slow requests, have your AI query traces across multiple services, pull matching metrics, and surface which service introduced the latency.
• Security event correlation: Use Claude to search for failed login attempts, then correlate them with network traffic anomalies and firewall blocks to identify attack patterns.

Full install guides for Claude Desktop, Cursor, Windsurf, and more at CuratedMCP.