A Model Context Protocol server for Splunk - search, manage, and analyze Splunk data via LLMs
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-server-splunk","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# Splunk MCP Server Search and manage Splunk from Pi, Claude Code, and Codex using [MCP](https://modelcontextprotocol.io/). ## Connection Install [uv](https://docs.astral.sh/uv/getting-started/installation/), then run **one** of these Bash examples. Replace `localhost` with your Splunk hostname. **Token:** ```bash export SPLUNK_HOST=localhost read -rsp 'Splunk token: ' SPLUNK_TOKEN; echo export SPLUNK_TOKEN ``` Create a token in Splunk Web: **Settings → Tokens → New Token**. **Or username/password:** ```bash export SPLUNK_HOST=localhost unset SPLUNK_TOKEN export SPLUNK_USERNAME=your-username read -rsp 'Splunk password: ' SPLUNK_PASSWORD; echo export SPLUNK_PASSWORD ``` Launch your client from the same terminal. Restart it if it is already running. ## Installation ### Pi ```bash pi mcp add splunk -- uvx mcp-server-splunk@latest pi mcp list pi ``` ### Claude Code ```bash claude mcp add --transport stdio --scope user splunk -- uvx mcp-server-splunk@latest claude mcp list claude ``` ### Codex Add to `~/.codex/config.toml`: ```toml [mcp_servers.splunk] command = "uvx" args = ["mcp-server-splunk@latest"] env_vars = [ "SPLUNK_HOST", "SPLUNK_PORT", "SPLUNK_SCHEME", "SPLUNK_TOKEN", "SPLUNK_USERNAME", "SPLUNK_PASSWORD", ] ``` ```bash codex mcp list codex ``` ## Configuration | Variable | Default | Purpose | |----------|---------|---------| | `SPLUNK_HOST` | `localhost` | Splunk hostname, without scheme or port | | `SPLUNK_PORT` | `8089` | Management API port | | `SPLUNK_SCHEME` | `https` | `http` or `https` | | `SPLUNK_TOKEN` | — | Authentication token | | `SPLUNK_USERNAME` | — | Username when not using a token | | `SPLUNK_PASSWORD` | — | Password when not using a token | Use a token **or** username/password. A token takes precedence if both are set. The server does not load `.env` files automatically. ## Tools 91 tools cover searches, indexes, alerts, saved searches, dashboards, lookups, macros, KV Store, inputs, users, roles, apps, and server…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.