mcp-server-splunk
A Go implementation of the MCP server for Splunk, supporting STDIO and SSE (Server-Sent Events HTTP API) using the github.com/mark3labs/mcp-go SDK.
The MCP Server for Splunk is a robust implementation designed to facilitate seamless integration with Splunk through the Model Context Protocol (MCP). It supports both STDIO and SSE (Server-Sent Events HTTP API) modes, providing flexibility in how it can be deployed and interacted with. The server is built using the Go programming language and leverages the mcp-go SDK, ensuring efficient and reliable performance. This server is particularly useful for managing and retrieving data from Splunk, such as saved searches, alerts, fired alerts, indexes, and macros. It also includes tools for listing these elements with various filtering options, making it a powerful tool for Splunk administrators and users who need to automate or streamline their workflows.
Features
- Supports both STDIO and SSE modes for flexible deployment.
- Built using Go and the mcp-go SDK for efficient performance.
- Provides tools for listing Splunk saved searches, alerts, fired alerts, indexes, and macros.
- Includes filtering options for more precise data retrieval.
- Integrates with Cursor for enhanced LLM context utilization.
Tools
list_splunk_saved_searches
Lists saved searches in Splunk with optional pagination.
list_splunk_alerts
Lists alerts in Splunk with optional filtering by title and pagination.
list_splunk_fired_alerts
Lists fired alerts in Splunk with optional filtering by search name and time range.
list_splunk_indexes
Lists indexes in Splunk with optional pagination.
list_splunk_macros
Lists macros in Splunk with optional pagination.
