Splunk

This connector bridges the Splunk MCP Server, the official app by Splunk (Splunkbase app 7931), on your Splunk Cloud Platform or Splunk Enterprise search head. Splunk's own server provides the tools: SPL searches, saved searches, indexes, hosts and sources, knowledge objects, KV Store, users and, where Splunk AI Assistant is available, the saia_* tools that write, explain and optimise SPL. AnythingMCP puts them behind your MCP endpoint with OAuth for Claude and ChatGPT, per-tool roles, the audit log and response mapping, next to your other systems.

The tools come from your server. At install AnythingMCP asks your Splunk MCP Server which tools it has, so you get exactly the set of the app version you run. After upgrading the app in Splunk, open the connector and click Discover tools to pick up new ones.

Setup (about 10 minutes, needs a Splunk admin):

1. Install Splunk MCP Server from Splunkbase on the search head (or search head cluster). Make sure REST API access and token authentication are enabled.
2. Give the role that will run the tools the mcp_tool_execute capability, and restrict that role to the indexes the AI may read. The role is the real boundary: the agent sees whatever this user sees.
3. In the Splunk MCP Server app, generate an encrypted MCP token for that user and copy it (Splunk shows it once). An ordinary Splunk user or service token does not work: Splunk refuses it with "invalid token audience" (HTTP 403).
4. Fill in the variables and install:
   • SPLUNK_HOST: the search head's host name, without https:// and without a port, for example yourstack.splunkcloud.com. The connector calls https://SPLUNK_HOST:8089/services/mcp, the address the app shows. If yours uses another port or path, change the base URL in the connector editor after installing.
   • SPLUNK_MCP_TOKEN: the encrypted token from step 3. It is stored encrypted.

Network: AnythingMCP connects to the management port (8089). On Splunk Cloud Platform that port only answers addresses on your stack's IP allow list for the search API (Admin Config Service), so add the address AnythingMCP calls from (on AnythingMCP Cloud, ask support for the current egress IP). Splunk Enterprise needs a certificate on 8089 that the AnythingMCP server trusts.

Safety: Splunk marks splunk_run_query and splunk_run_saved_search as able to change data, because SPL can write (collect, outputlookup, delete). Give the token's user a role that cannot write to indexes or lookups. The two dashboard tools install switched off; turn them on per tool if the AI should create or change dashboards. Splunk admins can also disable tools for everyone in the app, and Invalidate all MCP access tokens there revokes every token at once.

Working with it: start with splunk_get_indexes or splunk_get_metadata to see what data exists, always give searches a time range (earliest/latest) and a row limit, and let saia_generate_spl draft SPL you are unsure about. A 403 on install means the token is not an MCP token or the role lacks mcp_tool_execute; a timeout usually means the allow list or a firewall blocks port 8089.