MCP Server tools

The Splunk MCP Server provides several tools to interact with Splunk software.

Tool namespacing

Tools are namespaced based on their source. See the following table for prefix and source information:

Prefix Source
splunk_ Splunk core platform tools
saia_ Splunk AI Assistant tools
Note: Splunk platform tools are turned on by default.

The Splunk MCP server provides several tools to interact with Splunk software. See the following table for tool names and descriptions:

Tool name Description Date added
find_data_source Use natural language to surface the data you want searched, rather than searching all indexes. Results are presented as a shortlist, ranked by relevance.
Note: This tool is offered as a preview with MCP version 1.3.
July 2026
splunk_run_query Execute a Splunk search query and return the results. This is the primary tool for running Splunk searches using Splunk Search Processing Language (SPL). Use this to retrieve log data, perform aggregations, analyze events, and extract insights from your Splunk environment.

Version 1.3 and higher of MCP Server supports SPL2 as well as SPL searches. SPL2 runs with the same guardrails and includes the following commands:

  • fasearch

  • multireport

  • sdselect

  • return

  • timewrap

  • cluster

The prefix of @spl2 is required, as shown in the following example:

PYTHON 
@spl2 from index:_internal\n | stats count() as event_count Response -> 5092017

For more information on SPL2 see theSPL2 Search Reference​ manual.

Version 1.3 and higher offers workload management for the splunk_run_query tool. For more information see the Guardrail triggers and workload management for splunk_run_query section.

 July 2025
splunk_get_info Get comprehensive information about your Splunk instance. Retrieves system information including version, hardware specifications, and operational status. July 2025
splunk_get_indexes Get a list of indexes from Splunk. Indexes are data repositories where machine data is stored and organized. July 2025
splunk_get_index_info Get detailed information about a specific Splunk index. Returns comprehensive configuration and status information for the specified index. July 2025
splunk_get_metadata Retrieve metadata about hosts, sources, or sourcetypes across 1 or more indexes in the selected time window. July 2025
splunk_get_user_info Retrieves detailed information about the currently authenticated user including roles and permissions. Returns comprehensive user profile data for the current session. July 2025
splunk_get_user_list Get a list of users from Splunk. Retrieves information about all users including authentication details, roles, and account status. July 2025
splunk_get_kv_store_collections Get KV Store collection statistics including size, count, and storage information. Retrieves comprehensive metrics about all KV Store collections in the Splunk instance. July 2025
splunk_get_knowledge_objects Retrieve Splunk knowledge objects by type. Supports various knowledge object types including saved searches, alerts, field extractions, lookups, macros, and data models. Refer to the full list of supported types later in this topic. July 2025
saia_generate_spl Generate SPL from natural language searches using Splunk AI Assistant for SPL. September 2025
saia_explain_spl Explain SPL queries in natural language using Splunk AI Assistant for SPL. Converts complex SPL commands into human-readable explanations. September 2025
saia_optimize_spl Optimize SPL searches using Splunk AI Assistant for SPL. Improves search performance, efficiency, and follows best practices. September 2025
saia_ask_splunk_question Ask natural language questions about Splunk using Splunk AI Assistant for SPL. Get explanations about Splunk commands, concepts, features, and best practices. September 2025
splunk_run_saved_search Beta feature that lets AI assistants run your existing Splunk saved searches directly through MCP. See Beta feature: Run Saved Search. April 2026

Guardrail triggers and workload management for splunk_run_query

The splunk_run_query tool is the primary tool for running Splunk searches using Splunk Search Processing Language (SPL) and SPL2.

Note: Support for SPL2 is available with version 1.3 and higher. When searching with SPL2 the

prefix of @spl2 is required.

Guardrail triggers

The splunk_run_query tool is intended for quick searches that are deemed safe and non-destructive. The tool might fail and trigger a guardrail for 1 or more of the following reasons:

  • If the search contains commands that are deemed unsafe or destructive, the MCP server might not execute the search.
  • The execution time exceeds 1 minute.
  • The number of events in the response exceeds 1000.

Workload management

Workload management (WLM) can help allocate system resources among different workloads. Workload pools define how those resources are assigned. When using Splunk MCP Server version 1.3 and higher you can use workload management to create a workload pool for the splunk_run_query tool.

Taking this step moves splunk_run_query into a detached, asynchronous search job.

For detailed steps on creating workload pools in Splunk Enterprise see Configure workload pools in the Administer Splunk Enterprise manual.

Splunk Cloud Platform user can learn more about workload pools in Workload Management overview in the Administer Splunk Cloud Platform manual.

To use the workload pool, call splunk_run_query with the exact pool identifier as shown in the following example:

JSON 
{
  "method": "tools/call",
  "params": {
    "name": "splunk_run_query",
    "arguments": {
      "query": "| makeresults | eval marker=\"mcp_pool_probe\"",
      "workload_pool": "mcp_low_priority"
    }
  }
}

Supported knowledge object types

The following knowledge object types are supported by get_knowledge_objects:

  • saved_searches

  • alerts

  • field_extractions

  • field_aliases

  • calculated_fields

  • lookups

  • automatic_lookups

  • lookup_transforms

  • macros

  • tags

  • data_models

  • workflow_actions

  • views

  • panels

  • apps

  • mltk_models

  • mltk_algorithms