Unlock the Power of Splunk Cloud Platform with the MCP Server

The fast advancement of AI has made getting valuable data insights from Splunk and across your operational environment so much easier. Today, we’re announcing the controlled availability of MCP (Model Context Protocol) server in Splunk Cloud Platform — a ground breaking tool that bridges the gap between Splunk’s robust data analytics capabilities and the power of AI reasoning and automation. By connecting AI models (LLMs) to Splunk through the Model Context Protocol, teams can build AI assistants/agents to interact with their data in intuitive, secure, and efficient ways. This tool is also listed in the AI Agents and Tools storefront in AWS Marketplace.

Let’s dive into why this innovative solution is changing how organizations can harness their data.

What Is the MCP Server?

The MCP server is a specialized implementation of the Model Context Protocol, an open standard pioneered by Anthropic, to enable secure, two-way communication between AI systems and external tools like Splunk Cloud Platform. Think of it as a universal translator that allows AI assistants, such as Claude or ChatGPT, to “talk” to Splunk using natural language to access valuable data insights. This means you can query complex datasets, manage indexes, execute searches, and even handle KV store operations without writing a single line of SPL (Splunk Processing Language) or navigating intricate dashboards.

The MCP server acts as a secure bridge, ensuring that AI interactions respect existing authentication and access controls while delivering real-time AI insights. Whether you’re a security analyst hunting for threats, a DevOps engineer monitoring applications and infrastructure, or a business leader seeking data-driven decisions, this tool simplifies and accelerates your workflow with AI.

How Can the MCP Server Help?

1. Easier to use with natural language interaction 

Without being a Splunk SPL (Search Processing Language) expert, now anyone can use natural language to unlock the platform’s full potential. With the MCP server, you can ask questions like, “What are the top alerts from the past 24 hours?” or “Show the performance latency of my check-out app.” The AI translates these queries into Splunk searches, taking additional actions, and delivering answers in plain English. This democratizes data access, empowering executives, product developers, and analysts to explore Splunk data without needing technical expertise.

2. Enhanced security and control 

Security is paramount when integrating AI with enterprise systems. The MCP server ensures that AI interactions adhere to your organization’s existing Splunk authentication and access controls, preventing unauthorized data exposure. It supports robust auditing, logging, and input validation to monitor for malicious payloads or command injection attempts, making it a trusted solution for security-critical applications.

3. Simpler integration with your ecosystem  

The MCP server is intended to integrate with a broader ecosystem. You can combine Splunk data with other sources, such as Atlassian (Jira, Confluence), cloud APIs, or even Kubernetes clusters, to create a unified view of your operations. For example, a security team could use the MCP server alongside Jira, or ServiceNow for cross-platform incident investigation and resolution, all through a single natural language interface.

4. Boosted productivity with automation   

By enabling AI to execute Splunk searches, manage saved searches, or even create reports, the MCP server automates repetitive tasks, saving valuable time. Imagine automating log analysis, generating real-time alerts, or retrieving index metadata with a simple command like, “List all Splunk indexes and their sourcetypes.” This efficiency is a big productivity booster for security operations centers (SOCs) and IT teams.

5. Available with Splunk Cloud Platform  

The MCP server is hosted and available with your Splunk Cloud Platform on commercial AWS regions.

Possible Use Cases

• Security Operations: A SOC analyst uses the MCP server to query Splunk for real-time threat intelligence, asking, “Show me all failed login attempts from external IPs in the last hour.” The AI executes the search and returns a concise report, reducing response time.  
• DevOps Efficiency: A DevOps engineer asks, “What’s the performance trend of my Kubernetes cluster logs in Splunk?” The MCP server pulls the data and visualizes it, streamlining monitoring tasks. 
• Business Insights: A product manager queries, “What’s driving customer churn in Q2?” The MCP server combines Splunk data with external sources, delivering a comprehensive analysis without requiring manual dashboard creation.
• Multi-App Insights: Connect Confluence MCP server, containing Splunk system and data organization knowledge, with Splunk MCP server, to deliver more accurate insights.
• Analytics Automation: Analyst asks, “Identify infrastructure performance anomalies over the past month that I should worry about.” The LLM client, through the MCP server, will direct Machine Learning Toolkit (MLTK) to perform the anomaly detection analysis of CPU, GPU, memory, disk usage, etc. and bring back a summary report.

Getting Started With the MCP Server

Ready to transform how your team interacts with Splunk Cloud Platform? For the admin, here’s how to get started:  

1. Find how-to setup here 
2. Enable API access and token authentication if you have not done that already
3. Set (role based) access control

When the Admin has completed the above steps, Splunk users who have the new role can create a new token for MCP and configure it in a client of their choice.

See documentation for any questions. 

The Future of AI and Splunk

Splunk’s first MCP Server is more than a tool—it’s a glimpse into the future of AI-driven agentic workflows. By combining Splunk’s data platform with the power of AI, organizations can deliver performance reliability, enhance security, and unlock faster insights for everyone. As the MCP ecosystem grows, expect even more integrations and capabilities, from real-time collaboration to advanced insights.

Don’t wait to revolutionize your data strategy. Activate the MCP server for Splunk Cloud Platform today and start asking your data for answers you’ve always wanted to know!

Join the AI Revolution With Splunk’s MCP Server

The MCP server is your key to unlocking the full potential of your Splunk data. By blending AI’s power with Splunk’s analytical prowess, it empowers teams to work smarter, not harder. Try it now and see how AI can transform your data-driven decisions!