Skip to main content
Lantern Home

 

Splunk Lantern

Getting started with the Splunk MCP server

  1. Last updated
  2. Save as PDF

Artificial intelligence without enterprise data is guesswork, but most business data is locked in tools and silos. Security measures and role-based access control limit access needed to develop useful AI tools. This is where a model context protocol (MCP) server can come in useful. MCP is a standard way for agentic apps to talk to (non-agentic) applications, meaning tools and data. Adding an MCP server to your workflow enhances the knowledge and value of your agentic apps.

MCP is especially valuable when combined with the power of the Splunk platform. Every Splunk deployment is a lake of operational truth: logs, metrics, traces, security data, and business signals. MCP turns the Splunk platform into an AI-ready data source. The benefits include:

  • The ability to validate AI results by seeing the SPL behind the queries
  • Splunk indexes are not bulk-copied into the AI application; the MCP server returns only the authorized results of requested tool calls
  • You select what indexes the MCP user can access
  • All actions are auditable

To take advantage of these benefits, continue reading so you can get started with the Splunk MCP server.

How to accomplish this use case with Splunk software

What are the components?

  • Host: Your AI Agent, for example, VS Code or the LM Studio app. This initializes a session to the MCP Server via the MCP client. It also summarizes results into human-readable formats.
  • MCP Client: This manages all interactions with the server via JSON-RPC v2. This layer helps your model understand how to work with the server.
  • MCP Server: This is the service through which your data application exposes different types of capabilities to the MCP client. The MCP server communicates with the applications through APIs to extract the following:
    • Resources: These are contextual, static data (like files and tables). 
    • Tools: These are functions or business actions (such as image processing, execute command, etc). You can think of these like using REST POST functions. For more information, see MCP Server tools in Splunk Help. 
    • Prompts: These define responses for specific prompts.

The following is an example of a Splunk Enterprise deployment behind an AWS Application Load Balancer.

clipboard_e48c717b-7c60-4c87-b3de-08f665d19d73.png

To deploy the MCP server on your Splunk platform, you will follow these basic steps.

For detailed guidance on setting up the MCP server, see About MCP server for the Splunk platform.

  1. Install the Splunk MCP Server app from Splunkbase. In MCP 1.4, this will be a default app.
  2. Create a Splunk MCP role. 
    1. Select the mcp_tool_execute capability.
    2. (Optional) Select the mcp_tool_admin capability.
    3. Select the indexes it should be able to access.
  3. Create a new user with the MCP role.
  4. Create a token with the audience field set to MCP. 
  5. Copy your token. 
  6. Connect your agents.
    Use the example json to update your agent's mcp.json file. Additionally, for OAuth configurations, see OAuth for MCP Server.
  7. Test the agents by sending a question like "Tell me about my Splunk environment." You should see your agent use the splunk_get_info tool to retrieve the data.

Let's watch a demo of the whole process in action, with specific use cases.

Next steps

Now that you have an idea of how easy it is to get started with the Splunk MCP Server, watch the full talk from Cisco Live EMEA 2026, From Questions to Answers: Get Started with Splunk MCP and AI Agents in a Few Minutes. In the talk, you'll learn more about how an MCP server works, the benefits it brings, and how it helps your Splunk usage.

In addition, these resources might help you understand and implement this guidance: