Automating Splunk query results

[senmng]

I would like to use AI tool to automate the Splunk search capability. For instance, instead of using Splunk search using the query ,i would like to automate in such a way that I need to get the results by giving prompting in an UI client.

((index=*) OR (index = *)) sourcetype IN ("*","*") "errorcode"  | dedup sessionID

instead of writing this query in search bar, i would like to prompt in UI client using AI agent to ask to return the results the sessions with this errorcode by filtering out using unique session id

[PickleRick]

You can use the Splunk MCP server. It does seem to work - I tested it successfully with my local AI deployment. Be aware though that writing efficient searches for more complicated use cases is no easy feat so relying on an LLM (especially if it has not been trained for Splunk) might produce sub-par results.

[livehybrid]

Hi @senmng 

You problably want to look at the Splunk MCP app/server if you are wanting to query Splunk from your AI tooling, if its supported.

The search you provided - Thats possibly the most inefficient search Ive ever seen - I'm assuming this is just an example??

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Andre_]

I am using the Splunk MCP server for this too. Works well. 
Prompt: "list the indexes in my splunk instance" 
Response: the indexes as a list

btw: can't select the Splunk MCP as an "associated App" here