splunk-mcp-server

A lightweight, extensible Model Context Protocol (MCP) server for Splunk Enterprise, designed to integrate with Claude Desktop or any MCP-compatible agent. Enables secure, async, chat-based interaction with your Splunk data using FastMCP.

---

🔧 Supported Tools

• get_knowledge_objects
• search_splunk
• get_splunk_indexes
• get_log_stats
• get_all_users
• get_user_info
• search_errors

---

⚡ Features

• ⚡ Async HTTP client via httpx
• 🧩 Simple plugin-style architecture for adding tools
• 💻 Designed for local development or integration with Claude Desktop
• 🚀 Built with FastMCP and Python 3.13

🛠 Installation Guide

1. Install Claude Desktop

Download and install from Anthropic Claude Desktop (macOS only for now).

2. Install uv (Python package manager by Astral)

sudo curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR="/opt" sh

3. Clone the repository

git clone https://github.com/balajifunny/splunk-mcp-server.git
cd splunk-mcp-server

4. Set your Splunk Configurations

Update the Splunk configuration section in main.py

SPLUNK_HOST=127.0.0.1
SPLUNK_PORT=8089
SPLUNK_USERNAME=<your_splunk_username>
SPLUNK_PASSWORD=<your_splunk_password>
SPLUNK_SCHEME=https

5. Update Claude Desktop configuration

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "splunk-mcp-demo": {
      "command": "/opt/uv",
      "args": [
        "run",
        "--with",
        "mcp[cli]",
        "mcp",
        "run",
        "/Users/<your_user_name>/splunk-mcp-server/main.py"
      ]
    }
  }
}