AI Plugin Indexobservability
Splunk MCP servers and skills
There are 9 ways to connect Splunk to Claude, ChatGPT, Cursor and other AI assistants: 4 MCP servers and 5 skills. The most used is Splunk MCP (0 GitHub stars).
Most used
Use when Token Meter GitHub issues, pull requests, review requests, checks, comments, merges, or closure need to be managed.
A Model Context Protocol server for interacting with Splunk Enterprise/Cloud
Scaffold, build, modify, debug, test, and package Canvas 2D custom visualizations for both Splunk frameworks: the legacy Simple XML/Backbone framework using SplunkVisualizationBase, AMD, formatter.html, and webpack; and the native Dashboard Studio extension framework using @splunk/dashboard-studio-extension, config.json dynamic editors, iframe isolation, esbuild, and the @splunk/create CLI. Also use for visualizations.conf framework selection, Splunk Cloud vetting, HiDPI canvas issues, custom fonts, drilldowns, local harnesses, and apps that bundle multiple visualizations.
Model Context Protocol server for the Splunk UI Design System
Model Context Protocol server for Splunk: SPL search, dashboards (Studio + Classic), reports, and alerts via management REST—browser SSO cookies, ACL-aware reads/writes, documentation-first authoring.
props.conf — all tasks. Trigger for: event breaking, line breaking, SHOULD_LINEMERGE, LINE_BREAKER, timestamp parsing, TIME_FORMAT, TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD, MAX_DAYS_AGO, TZ, TRUNCATE, field extractions, EXTRACT-, REPORT-, EVAL-, FIELDALIAS-, KV_MODE, LOOKUP-, TRANSFORMS-, search-time extractions, index-time extractions, source type configuration, multiline events, event merging. Default: Splunk Enterprise 9.x.
MCP servers (4)
- 1Splunk MCP MichaelSp · Knowledge and memoryA Model Context Protocol server for interacting with Splunk Enterprise/Cloud64
- 2Splunk UI MCP splunk_sui_publish · DesignModel Context Protocol server for the Splunk UI Design System57
- 3Splunk Platform MCP Wasim-Shaikh25 · Browser automationModel Context Protocol server for Splunk: SPL search, dashboards (Studio + Classic), reports, and alerts via management REST—browser SSO cookies, ACL-aware reads/writes, documentation-first authoring.43
- 4Rsfl Splunk MCP Server chatflowdevSplunk MCP Server25
Skills (5)
- 1token-meter-github-ops splunk · Developer toolsUse when Token Meter GitHub issues, pull requests, review requests, checks, comments, merges, or closure need to be managed.69
- 2splunk-viz rcastley · Developer toolsScaffold, build, modify, debug, test, and package Canvas 2D custom visualizations for both Splunk frameworks: the legacy Simple XML/Backbone framework using SplunkVisualizationBase, AMD, formatter.html, and webpack; and the native Dashboard Studio extension framework using @splunk/dashboard-studio-extension, config.json dynamic editors, iframe isolation, esbuild, and the @splunk/create CLI. Also use for visualizations.conf framework selection, Splunk Cloud vetting, HiDPI canvas issues, custom fonts, drilldowns, local harnesses, and apps that bundle multiple visualizations.62
- 3splunk-conf-props cmwema · Search and webprops.conf — all tasks. Trigger for: event breaking, line breaking, SHOULD_LINEMERGE, LINE_BREAKER, timestamp parsing, TIME_FORMAT, TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD, MAX_DAYS_AGO, TZ, TRUNCATE, field extractions, EXTRACT-, REPORT-, EVAL-, FIELDALIAS-, KV_MODE, LOOKUP-, TRANSFORMS-, search-time extractions, index-time extractions, source type configuration, multiline events, event merging. Default: Splunk Enterprise 9.x.27
- 4splunk kbarbel640-del · Search and webSearch and analyze machine data via Splunk API. Run searches and manage dashboards.26
- 5splunk-indexes byrn-bakerDiscover and inspect Splunk indexes and configuration.21
Questions
Is there an official Splunk MCP server?
Check the publisher on each listing: servers published by Splunk itself are the official ones. The most used Splunk server here is Splunk MCP by MichaelSp.
How do I connect Splunk to Claude?
Pick a server below, open its page and copy the install command for Claude Code, or the config block for Claude Desktop. Most Splunk servers need an API key or token from your Splunk account.