Official Splunk MCP server for log analysis
## Splunk MCP Server: Security & Observability The **Splunk MCP Server** integrates Splunk's powerful data platform into Google Antigravity, enabling developers to search, analyze, and visualize machine data for security monitoring, operational intelligence, and application debugging. ### Why Splunk MCP? - **Universal Log Search**: Search across all log sources with SPL (Search Processing Language) - **Real-Time Monitoring**: Create alerts and dashboards for live operational data - **Security Analytics**: Detect threats with built-in security intelligence - **Custom Dashboards**: Build interactive visualizations for any data source - **Machine Learning**: Apply ML to identify anomalies and predict issues ### Key Features #### 1. Log Search and Analysis ```python # Execute Splunk search via MCP results = await splunk.search({ "query": "search sourcetype=application level=error | stats count by service", "earliest_time": "-24h", "latest_time": "now" }) # Get search results for row in results: print(f"Service: {row.service}, Errors: {row.count}") # Time-based analysis timechart = await splunk.search({ "query": "search sourcetype=web_logs | timechart span=1h count", "earliest_time": "-7d" }) ``` #### 2. Alerting and Dashboards ```python # Create saved search with alert await splunk.createSavedSearch({ "name": "High Error Rate Alert", "search": "search level=error | timechart span=5m count | where count > 100", "alert_type": "number of events", "alert_threshold": 1, "actions": ["email", "slack"], "cron_schedule": "*/5 * * * *" }) # Get dashboard data dashboard = await splunk.getDashboard("operations_overview") panels = await splunk.executeDashboardPanels(dashboard.id) ``` ### Configuration ```json { "mcpServers": { "splunk": { "command": "npx", "args": ["-y", "@anthropic/mcp-splunk"], "env": { "SPLUNK_HOST": "your-splunk-instance.com", "SPLUNK_PORT": "8089", "SPLUNK_USERNAME": "your-username", "SPLUNK_PASSWORD": "your-password" } } } } ``` ### Use Cases **Security Operations**: Monitor for security threats, investigate incidents, and maintain compliance with audit logs. **Application Debugging**: Trace requests across services and quickly identify root causes of issues. **Infrastructure Monitoring**: Aggregate and analyze logs from servers, containers, and cloud services. The Splunk MCP Server brings enterprise-grade log analytics into your development workflow.
{
"mcpServers": {
"splunk": {
"mcpServers": {
"splunk": {
"env": {
"SPLUNK_HOST": "localhost",
"SPLUNK_PORT": "8089",
"SPLUNK_TOKEN": "YOUR_SPLUNK_TOKEN"
},
"args": [
"-y",
"@splunk/mcp-server"
],
"command": "npx"
}
}
}
}
}