Hi everyone, I've been testing the official Splunk MCP Server app from Splunkbase with Claude Desktop and noticed a concerning issue — the MCP server intermittently returns completely fabricated data instead of actual query results. Environment: Splunk Enterprise 10.2.0 on Linux Official Splunk MCP Server from Splunkbase, version 1.0.0 Claude Desktop as MCP client What I'm seeing: When running tstats queries against datamodels (Authentication, Endpoint.Processes), the results returned via MCP sometimes contain plausible-looking but completely fake data — usernames that don't exist, wrong countries, incorrect counts. Examples: Query for failed auth by user returned "james.smith", "j.smith", etc. — users that don't exist in my environment Query for failed auth by country returned Russia and China — actual data shows Nigeria and Albania Same query run multiple times returns different fabricated data, then sometimes the correct data Pattern observed: Simple/fast queries (index lists, basic stats) → Usually correct Zero-result queries → Correct (returns empty) Complex datamodel queries → Intermittent fabrication Re-running the same query → Sometimes fixes it, sometimes returns different fake data My suspicion: The MCP server documentation mentions guardrails including a 1-minute timeout. When queries timeout, instead of returning an error, something appears to be generating fake "plausible" responses. This could be an LLM component filling in the blanks. Questions: Has anyone else experienced this behavior? Is there an LLM/AI component in the MCP server that generates responses on timeout/failure? Is there a way to disable any fallback response generation and just return errors? Are there logs I can check to see what's happening when this occurs? This is a critical issue - we can't have a tool silently returning fake data that looks real. I'd rather get an error than incorrect results. Thanks for any insights!
... View more