Security and operations teams who use Splunk Enterprise or Splunk Cloud for log search and alerting.

An MCP server that runs SPL searches, lists saved searches and alerts, and returns Splunk index results to an agent.

Deployed as a local server or Splunkbase app that connects to a Splunk management REST endpoint.

Used during incident response when an agent needs to correlate logs across indexes in natural language.

Turns ad hoc SPL query writing into a conversational task for on-call engineers.

Requires a Splunk management endpoint URL plus a username or token with search privileges on the target indexes.

Splunk publishes an official app on Splunkbase alongside community implementations such as splunk-mcp-server2 under the splunk GitHub org; licensing varies by implementation (mostly MIT or Apache-2.0) and credentials can read sensitive log data, so scope index access carefully.