Splunk MCP

Primary integration — connect agents to live Splunk for queries, docs, CIM, configs, and admin operations

Splunk MCP

Splunk MCP connects Deslicer AI agents to your live Splunk environment. Agents run SPL, inspect fields, reference CIM data models, access documentation, and read configurations — all through MCP (Model Context Protocol).

Navigation

What Is MCP?

MCP (Model Context Protocol) is a standard protocol that lets AI tools call external systems. Instead of guessing, agents call tools that talk directly to your Splunk instance. They see real indexes, sourcetypes, fields, and configurations.

You configure Splunk MCP once. Agents use it automatically.

Setup

  1. Go to Settings → Integrations → Splunk MCP.
  2. Enter your Splunk REST API URL (e.g., https://your-splunk:8089).
  3. Provide credentials (username/password or Splunk auth token).
  4. Test the connection.
  5. Save.

Sensitive fields (passwords, tokens, API keys) are automatically masked in the integration editor. When you edit an existing integration, these fields show masked dots instead of the stored value. If you leave a sensitive field unchanged, the previously saved value is preserved — you only need to re-enter a field when you want to change it.

Agents can now query your Splunk, run searches, and inspect results.

Tool Capabilities

Splunk MCP exposes these tool categories to agents:

Search & Query

  • run_oneshot_search — execute ad-hoc SPL queries and return results
  • run_splunk_search — run longer searches with job management

Data Discovery

  • list_indexes — list all available indexes
  • list_sourcetypes — list sourcetypes with metadata
  • get_metadata — index and sourcetype metadata

CIM & Data Models

  • get_cim_data_model — retrieve a specific CIM data model definition
  • list_cim_data_models — browse all available CIM models
  • get_cim_reference — CIM field reference

Documentation

  • get_spl_reference — SPL command reference and syntax
  • list_spl_commands — browse all SPL commands
  • get_spl_command_help — detailed help for a specific SPL command
  • get_splunk_cheat_sheet — quick reference for common operations
  • discover_splunk_docs — search across Splunk documentation
  • get_splunk_documentation — retrieve specific doc pages

Admin & Troubleshooting

  • get_admin_guide — Splunk admin guides
  • get_troubleshooting_guide — troubleshooting guides by topic
  • list_troubleshooting_topics — browse troubleshooting categories
  • list_available_topics — all available doc topics

Dashboard Studio

  • get_studio_topic — Dashboard Studio documentation
  • list_dashboard_studio_topics — browse Dashboard Studio topics

Apps

  • list_apps — list installed Splunk apps

IT Service Intelligence (ITSI) Tools

Splunk MCP includes an optional ITSI toolset for organizations running Splunk ITSI. When enabled, agents gain access to 70+ additional tools for service health monitoring, KPI analysis, episode investigation, and notable event management.

Enabling ITSI

  1. Go to Settings → Integrations → Splunk MCP.
  2. Scroll to the IT Service Intelligence (ITSI) section (marked Optional).
  3. Toggle the switch to on.
  4. Save.

ITSI tools use the same Splunk credentials you already configured — no additional connection setup is needed. Your Splunk instance must have ITSI installed for the tools to work.

You can also enable ITSI during the welcome onboarding wizard when configuring your Splunk connection for the first time.

What ITSI Tools Provide

With ITSI enabled, agents can:

  • Monitor service health — query service trees, health scores, and KPI status
  • Analyze KPIs — inspect thresholds, trending, and anomalies across services
  • Investigate episodes — review grouped notable events, timelines, and root cause analysis
  • Manage notables — list, filter, and triage notable events by severity and status

When ITSI is disabled (the default), these tools are hidden and agents only see the core Splunk MCP tools listed above.

Deployment Support

Splunk MCP connects to:

  • Splunk Enterprise — on-prem and self-hosted
  • Splunk Cloud — cloud-hosted instances
  • Hybrid — mixed deployments

You configure the REST API URL and credentials for your environment.

Why It Matters

Without Splunk MCP, agents guess field names and sourcetypes. With it, they see your actual data — suggestions match your environment, SPL runs correctly, and CIM mappings reference real data models. You spend less time fixing AI output and more time acting on results.