All Apps and Add-ons

mcp SERVER

Eran
Engager

Hi all,
I have a few questions regarding the application:

Do I install the application directly on my Search Head? In that case, does it function as the the MCP SERVER??

If I have a Search Head Cluster, should I install the application on all members of the cluster?

How does the Agent communicate with the MCP? Specifically, how do I connect the MCP to my LLM model?

Thanks in advance!

Labels (1)
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @Eran 

If you havent already its worth checking out https://www.splunk.com/en_us/blog/artificial-intelligence/unlock-the-power-of-splunk-cloud-platform-... and https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/about-the-mcp-server...

Regarding your questions, you should install the MCP Server on all members in your SHC. 

Once installed you can configure your client with help from https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/connect-and-use-an-m...- It is your client which will connect to the LLM and then utilise the tools from the MCP Server. The MCP server itself does not connect to the LLM.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

livehybrid
SplunkTrust
SplunkTrust

Hi @Eran 

If you havent already its worth checking out https://www.splunk.com/en_us/blog/artificial-intelligence/unlock-the-power-of-splunk-cloud-platform-... and https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/about-the-mcp-server...

Regarding your questions, you should install the MCP Server on all members in your SHC. 

Once installed you can configure your client with help from https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/connect-and-use-an-m...- It is your client which will connect to the LLM and then utilise the tools from the MCP Server. The MCP server itself does not connect to the LLM.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

splunkreal
Influencer

Thank you @livehybrid 

* If this helps, please upvote or accept solution if it solved *
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...