Set up the Splunk MCP Server
Follow these steps to set up the Splunk MCP Server for your deployment.
Prerequisites
You must allow for API access and token authentication:
-
Splunk Cloud Platform: Allow REST API access for your Splunk platform deployment. For more information, see the Accessing the Splunk Cloud Platform REST API.
-
All deployments: Allow token authentication for all Splunk platform instance deployments. For more information, see Enable token authentication for a Splunk platform instance.
Set up steps
Complete the following steps to download, install, and configure the Splunk MCP Server app.
Step 1: Download and install the Splunk MCP Server app from Splunkbase
The Splunk MCP Server app is available on Splunkbase. The Splunk MCP Server app can be installed on your Splunk Search Head (SH) or Search Head Cluster (SHC).
For Splunk Cloud Platform installation steps, see Install an add-on in Splunk Cloud Platform. For Splunk Enterprise, follow installation procedures from Installing Splunk add-ons.
Step 2: Establish role-based access
The MCP Server app adds 2 new capabilities for role-based access control:
| Capability | Description |
|---|---|
mcp_tool_execute |
Grants users access to use the MCP server tools. |
mcp_tool_admin |
Grants administrative access for tool management and token creation. |
Add the mcp_tool_execute capability to any new or existing roles that need access to MCP server functionality. Access the APIs is also required.
(Optional) Map roles to MCP tools
Administrators can optionally restrict access to individual MCP tools by mapping Splunk roles to those tools. Users must have an allowed role to view or execute a restricted tool, except for administrators with the mcp_tool_admin capability.
Complete the following steps:
-
In the MCP Server app select Setting and then Tools.
-
From the listed Tools, select the
>icon for a detailed view of that tool. The following image shows an example MCP instance: -
Select Edit roles.
-
From the resulting modal window, select roles from the Roles allowed drop-down menu. The following image shows an example MCP instance:
Note: Roles withmcp_tool_admincapability always have full access and are not listed above -
Select Save when done.
Note: Saving with no roles selected clears the policy, meaning the tool will be accessible to all users with themcp_tool_executecapability.
Step 3: (Optional) Install Splunk AI Assistant
To make AI tools such as generate_spl, explain_spl, optimize_spl, and ask_splunk_question available in the MCP server, Splunk AI Assistant must be installed. To learn more see About Splunk AI Assistant.