Splunk MCP Server

[Narendra_Rao]

I'm working on observability tooling and have built a MCP bridge that routes queries / Admin activities for splunk along with several other tools .

How do i get if their is some existing MCP's built already for splunk and move way ahead?

Happy to collab!

[livehybrid]

Hi @Narendra_Rao 

If you’re looking for something for Splunk Cloud then check out https://www.splunk.com/en_us/blog/artificial-intelligence/unlock-the-power-of-splunk-cloud-platform-...

Having looked at the .conf25 sessions it sounds like there will be an official Splunk Enterprise MCP server released/announced then, for now it’s just cloud.
 

In the meantime, back in April I built https://github.com/livehybrid/splunk-mcp which I’ve been using with a couple of customers and currently testing a Splunk native app version which should be updated in GitHub soon. 

Ultimately if you’re not in a hurry then it’s worth waiting to see what’s announced at Conf or using an existing open source version in the meantime. 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[Narendra_Rao]

We are currently implementing MCP (Model Context Protocol) for our daily operations with Splunk Enterprise on-premise. I need to clarify the architecture and access patterns for our setup:

Current Challenges:

1. Token Provisioning: How should admins provision tokens to different teams for MCP access?
2. MCP Splunk Hosting: What's the recommended approach to host MCP server for Splunk integration?
3. Cross-Team Access: How can we enable other teams to access our MCP Splunk instance?
4. VS Code Integration: What's the proper way to connect VS Code → Augment → Splunk MCP?
   
   Any Help on this ?