Title: MCP Server tools | Splunk Enterprise, Splunk Cloud Platform, Observability Cloud (last updated 2026-09-01T21:02:16.102Z)
URL Source: https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/2.0/mcp-server-tools
Markdown Content:
Gain operational intelligence by collecting, indexing, and visualizing data using a powerful on-premises engine for actionable insights.
Release Notes ## Splunk Cloud Platform
Collect, index, and visualize your data in the cloud for better operational intelligence.
Release Notes ## Splunkbase
Discover, share, and install apps and add-ons with the Splunk community on Splunkbase. Publish your own or add others to your Splunk platform instance.
DATA MANAGEMENT
* [Common Information Model](https://help.splunk.com/en/help.splunk.com/en/?resourceId=common_information_model_data_managemenet)
* [Data Inputs](https://help.splunk.com/en/help.splunk.com/en/?resourceId=data_inputs_cloud)
* [DB Connect](https://help.splunk.com/en/help.splunk.com/en/?resourceId=data_management_connect_rel_databases)
* [Edge Processing](https://help.splunk.com/en/help.splunk.com/en/?resourceId=dm_process_edge)
* [Forwarders](https://help.splunk.com/en/help.splunk.com/en/?resourceId=dm_forward)
* [Indexing](https://help.splunk.com/en/?resourceId=Splunk_Indexer_Aboutindexesandindexers)
* [Ingest Monitoring](https://help.splunk.com/en/?resourceId=concept-975233b7-8d1d-47d5-adb0-cd0785f5e858)
* [Stream](https://help.splunk.com/en/help.splunk.com/en/?resourceId=enterprise_stream)
* [Technical Add-Ons](https://help.splunk.com/en/?resourceId=concept-c5ad7f04-6bca-4062-9e2c-ab714eafe424)
SEARCH AND ANALYTICS
* [AI Toolkit](https://help.splunk.com/en/?resourceId=MLApp_User_AboutMLTK)
* [Alerts](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ent_alert_respond)
* [Analytics Workspace](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_Analytics_About)
* [Dashboard Studio](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_DashStudio_IntroFrame)
* [Federated Search](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_FederatedSearch_fsoptions)
* [Knowledge Objects](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ent_manage_knowledge_objects)
* [Search and Reporting App](https://help.splunk.com/en/?resourceId=Platform_Search_GetstartedwithSearch)
* [Simple XML Dashboards](https://help.splunk.com/en/?resourceId=Platform_Viz_Aboutthismanual)
* [SPL](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_Search_GetstartedwithSearch)
* [SPL2](https://help.splunk.com/en/help.splunk.com/en/?resourceId=SCS_SearchReference_Introduction)
ADMINISTRATION
* [Cloud Platform](https://help.splunk.com/en/help.splunk.com/en/?resourceId=cloud_admin)
* [Enterprise](https://help.splunk.com/en/help.splunk.com/en/?resourceId=enterprise_admin)
* [MCP Server for Splunk Platform](https://help.splunk.com/en/help.splunk.com/en/?resourceId=concept-f9907ee0-1798-4a1b-8b9a-51ef3087b005)
Gain operational intelligence by collecting, indexing, and visualizing data using a powerful on-premises engine for actionable insights.
Release Notes ## SOAR
Streamline your security operations with a SOAR system that integrates orchestration, playbook automation, and case management to enhance threat response.
ENTERPRISE SECURITY
* [Enterprise Security 8](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es8)
* [Enterprise Security 7](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es7)
* [Mission Control](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_mission_control)
* [Security Content Update](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_content_update)
* [User Behavior Analytics](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_uba)
SOAR
* [SOAR On-Premises](https://help.splunk.com/en/help.splunk.com/en/?resourceId=soar_on_prem)
* [SOAR Cloud](https://help.splunk.com/en/help.splunk.com/en/?resourceId=soar_cloud)
* [App for SOAR](https://help.splunk.com/en/help.splunk.com/en/?resourceId=soar_app)
* [App for SOAR Export](https://help.splunk.com/en/help.splunk.com/en/?resourceId=SOARExport_UserGuide_ReleaseNotes)
* [Automation Broker](https://help.splunk.com/en/help.splunk.com/en/?resourceId=AutomationBroker_AutomationBroker_Enhancements)
RELATED APPS
* [Attack Analyzer](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_attack_analyzer)
* [Asset and Risk Intelligence](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_asset_risk)
* [App for PCI Compliance](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_pci)
* [App for Fraud Analytics](https://help.splunk.com/en/help.splunk.com/en/?resourceId=FraudAnalytics_UserGuide_Overview)
* [InfoSec App](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ent_info_sec)
* [Security Essentials](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_essentials)
Prevent disruptions and optimize operations when you monitor and analyze your IT service with predictive analytics and machine learning.
Release Notes ## Content Packs
Collect, index, and visualize your data in the cloud for better operational intelligence.
Release Notes
ITSI
* [Event Analytics](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ITSI_EA_AboutEA)
* [Entity Integration](https://help.splunk.com/en/?resourceId=ITSI_Entity_About)
* [Modules](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ITSI_IModules_AboutITSIModules)
* [REST APIs](https://help.splunk.com/en/?resourceId=ITSI_RESTAPI_ITSIRESTAPIreference)
* [Service Insights](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ITSI_SI_AboutSI)
IT Ops
* [IT Essentials Work](https://help.splunk.com/en/help.splunk.com/en/?resourceId=itsi_ite_work)
* [IT Essentials Learn](https://help.splunk.com/en/help.splunk.com/en/?resourceId=itsi_learn)
ADMINISTRATION
* [IT Service Intelligence](https://help.splunk.com/en/?resourceId=ITSI_Configure_Abouttheproduct)
* [IT Essentials Work](https://help.splunk.com/en/help.splunk.com/en/?resourceId=itsi_ite_work)
* [Configuration File Reference](https://help.splunk.com/en/?resourceId=Splunk_Admin_Confreference)
EXTENSIONS
* [SAP Solutions](https://help.splunk.com/en/help.splunk.com/en/?resourceId=SAP_Config_About)
* [Infrastructure Monitoring Add-On](https://help.splunk.com/en/?resourceId=SIMAddon_Install_Overview)
Gain end-to-end visibility, troubleshoot in real-time, and optimize performance across infrastructure, applications, and user interfaces.
Release Notes
MONITORING
* [Alerts and Detectors](https://help.splunk.com/en/?resourceId=alerts-detectors-notifications_alerts-and-detectors_alerts-detectors-notifications)
* [Application Performance Monitoring](https://help.splunk.com/en/help.splunk.com/en/?resourceId=apm_intro-to-apm)
* [Infrastructure Monitoring](https://help.splunk.com/en/help.splunk.com/en/?resourceId=infrastructure_intro-to-infrastructure)
* [Digital Experience Monitoring](https://help.splunk.com/en/?resourceId=observability_cloud_EUM)
* [Observability Cloud for Mobile](https://help.splunk.com/en/help.splunk.com/en/?resourceId=observability_cloud_mobile)
* [On-Call](https://help.splunk.com/en/help.splunk.com/en/?resourceId=on_call)
DATA MANAGEMENT
* [AI Assistant](https://help.splunk.com/en/help.splunk.com/en/?resourceId=get-started_ai_assistant_in_observability_cloud)
* [Dashboards and Charts](https://help.splunk.com/en/help.splunk.com/en/?resourceId=data-visualization_dashboards_dashboards)
* [Integrations](https://help.splunk.com/en/help.splunk.com/en/?resourceId=gdi_integrations-list)
* [Logs](https://help.splunk.com/en/help.splunk.com/en/?resourceId=logs_intro-to-logs)
* [Metrics](https://help.splunk.com/en/help.splunk.com/en/?resourceId=metrics-and-metadata_metrics-landing)
* [OpenTelemetry Collector](https://help.splunk.com/en/help.splunk.com/en/?resourceId=gdi_opentelemetry_opentelemetry)
* [SignalFlow Analytics](https://help.splunk.com/en/?resourceId=analytics_signalflow-analytics-intro)
* [Search Reference](https://help.splunk.com/en/help.splunk.com/en/?resourceId=metrics-and-metadata_search)
ADMINISTRATION
* [Organization Management](https://help.splunk.com/en/help.splunk.com/en/?resourceId=admin_admin)
* [App Development](https://dev.splunk.com/observability/docs/)
* [API Reference](https://dev.splunk.com/observability/reference/)
Cloud-based application performance monitoring with AI-powered insights for hybrid and multi-cloud environments.
Release Notes ## AppDynamics On-Premises
Self-hosted application observability for regulated and sensitive environments.
Release Notes ## Virtual Appliance (Self-Hosted)
Pre-packaged, self-contained application monitoring solution based on modern Kubernetes architecture.
Release Notes
ESSENTIALS
* [Alert and Respond](https://help.splunk.com/en/?resourceId=alert-and-respond-485261580)
* [Agent Management](https://help.splunk.com/en/help.splunk.com/en/?resourceId=agent-management-485265069)
* [Dashboards and Reports](https://help.splunk.com/en/help.splunk.com/en/?resourceId=dashboards-and-reports-485261942)
* [Extensions](https://help.splunk.com/en/help.splunk.com/en/?resourceId=extend-appdynamics-485267042)
* [Licensing](https://help.splunk.com/en/help.splunk.com/en/?resourceId=appdynamics-licensing-513194409)
* [Tag Management](https://help.splunk.com/en/help.splunk.com/en/?resourceId=concept-53bfbd4b-f661-4f1c-a2b0-050232a84e6b)
MONITORING
* [Analytics](https://help.splunk.com/en/?resourceId=analytics-485264462)
* [Application Security Monitoring](https://help.splunk.com/en/?resourceId=application-security-monitoring-485265135)
* [Application Performance Monitoring](https://help.splunk.com/en/help.splunk.com/en/?resourceId=application-monitoring-485262182)
* [Database Visibility](https://help.splunk.com/en/help.splunk.com/en/?resourceId=database-visibility-485263541)
* [End User Monitoring](https://help.splunk.com/en/help.splunk.com/en/?resourceId=end-user-monitoring-485265386)
* [Infrastructure Visibility](https://help.splunk.com/en/help.splunk.com/en/?resourceId=infrastructure-visibility-485263833)
* [SAP Agent](https://help.splunk.com/en/help.splunk.com/en/?resourceId=sap_agent)
ADMINISTRATION
* [AppDynamics SaaS](https://help.splunk.com/en/help.splunk.com/en/?resourceId=appd_saas_accounts)
* [AppDynamics On-premises](https://help.splunk.com/en/help.splunk.com/en/?resourceId=appd_onprem_account)
Build and deliver apps and integrations with SDKs, APIs and tools. ## Splunkbase
Access and share apps and add-ons with the Splunk community on Splunkbase. Publish your own apps, or download and install others on your Splunk platform instance.
PLATFORM
* [Developer Guide](https://dev.splunk.com/enterprise/docs/welcome/)
* [REST APIs and Dev Tools](https://dev.splunk.com/enterprise/reference/)
* [Tutorials](https://dev.splunk.com/enterprise/tutorials/)
* [Downloads](https://dev.splunk.com/enterprise/downloads/)
* [Examples](https://dev.splunk.com/enterprise/examples/)
OBSERVABILITY
* [Developer Guide](https://dev.splunk.com/observability/docs/)
* [REST APIs](https://dev.splunk.com/observability/reference/)
REFERENCE
* [Python 3 Migration](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_Python3Migration_AboutMigration)
* [SOAR](https://help.splunk.com/en/?resourceId=concept-7e7dd9d8-a069-4cef-8780-fab1f46f5ce1)
* [SDK Reference](https://docs.splunk.com/Documentation/SDK)
* [UI Toolkit](https://help.splunk.com/en/dev.splunk.com/enterprise/docs/developapps/createapps/buildapps/)
Resources
Explore information on best practices, connect with community, or contact support.
REFERENCE
* [Configuration Files Reference](https://help.splunk.com/en/?resourceId=Splunk_Admin_Aboutconfigurationfiles)
* [REST APIs](https://help.splunk.com/en/?resourceId=ITSI_RESTAPI_ITSIRESTAPIreference)
* [SPL Reference](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_SearchReference_WhatsInThisManual)
* [Search Tutorial](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_SearchTutorial_WelcometotheSearchTutorial)
* [Validated Architectures](https://help.splunk.com/en/help.splunk.com/en/?resourceId=SVA_Architectures_About)
Learn More
* [Free Trials & Downloads](https://www.splunk.com/en_us/download.html)
* [Help Portal Release Notes](https://help.splunk.com/en/?resourceId=help_rn)
* [Splunk Community](https://community.splunk.com/)
* [Splunk Answers](https://community.splunk.com/t5/Find-Answers/ct-p/en-us-splunk-answers)
* [SPL 2 Reference](https://help.splunk.com/en/?resourceId=SCS_SearchReference_Introduction)
* [Splunk Lantern](https://lantern.splunk.com/)
Support
* [AppDynamics Support](https://www.splunk.com/en_us/customer-success/appdynamics-support.html)
* [Cisco Support](https://www.cisco.com/c/en/us/support/index.html)
* [Product Security Advisories](https://advisory.splunk.com/)
* [Splunk Support](https://www.splunk.com/en_us/customer-success/support-programs.html)
* [System Status](https://www.splunk.com/en_us/products/system-status.html)
EnglishJapanese
EnglishJapanese
Gain operational intelligence by collecting, indexing, and visualizing data using a powerful on-premises engine for actionable insights.
Release Notes ## Splunk Cloud Platform
Collect, index, and visualize your data in the cloud for better operational intelligence.
Release Notes ## Splunkbase
Discover, share, and install apps and add-ons with the Splunk community on Splunkbase. Publish your own or add others to your Splunk platform instance.
DATA MANAGEMENT
* [Common Information Model](https://help.splunk.com/en/help.splunk.com/en/?resourceId=common_information_model_data_managemenet)
* [Data Inputs](https://help.splunk.com/en/help.splunk.com/en/?resourceId=data_inputs_cloud)
* [DB Connect](https://help.splunk.com/en/help.splunk.com/en/?resourceId=data_management_connect_rel_databases)
* [Edge Processing](https://help.splunk.com/en/help.splunk.com/en/?resourceId=dm_process_edge)
* [Forwarders](https://help.splunk.com/en/help.splunk.com/en/?resourceId=dm_forward)
* [Indexing](https://help.splunk.com/en/?resourceId=Splunk_Indexer_Aboutindexesandindexers)
* [Ingest Monitoring](https://help.splunk.com/en/?resourceId=concept-975233b7-8d1d-47d5-adb0-cd0785f5e858)
* [Stream](https://help.splunk.com/en/help.splunk.com/en/?resourceId=enterprise_stream)
* [Technical Add-Ons](https://help.splunk.com/en/?resourceId=concept-c5ad7f04-6bca-4062-9e2c-ab714eafe424)
SEARCH AND ANALYTICS
* [AI Toolkit](https://help.splunk.com/en/?resourceId=MLApp_User_AboutMLTK)
* [Alerts](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ent_alert_respond)
* [Analytics Workspace](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_Analytics_About)
* [Dashboard Studio](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_DashStudio_IntroFrame)
* [Federated Search](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_FederatedSearch_fsoptions)
* [Knowledge Objects](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ent_manage_knowledge_objects)
* [Search and Reporting App](https://help.splunk.com/en/?resourceId=Platform_Search_GetstartedwithSearch)
* [Simple XML Dashboards](https://help.splunk.com/en/?resourceId=Platform_Viz_Aboutthismanual)
* [SPL](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_Search_GetstartedwithSearch)
* [SPL2](https://help.splunk.com/en/help.splunk.com/en/?resourceId=SCS_SearchReference_Introduction)
ADMINISTRATION
* [Cloud Platform](https://help.splunk.com/en/help.splunk.com/en/?resourceId=cloud_admin)
* [Enterprise](https://help.splunk.com/en/help.splunk.com/en/?resourceId=enterprise_admin)
* [MCP Server for Splunk Platform](https://help.splunk.com/en/help.splunk.com/en/?resourceId=concept-f9907ee0-1798-4a1b-8b9a-51ef3087b005)
Gain operational intelligence by collecting, indexing, and visualizing data using a powerful on-premises engine for actionable insights.
Release Notes ## SOAR
Streamline your security operations with a SOAR system that integrates orchestration, playbook automation, and case management to enhance threat response.
ENTERPRISE SECURITY
* [Enterprise Security 8](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es8)
* [Enterprise Security 7](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es7)
* [Mission Control](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_mission_control)
* [Security Content Update](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_content_update)
* [User Behavior Analytics](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_uba)
SOAR
* [SOAR On-Premises](https://help.splunk.com/en/help.splunk.com/en/?resourceId=soar_on_prem)
* [SOAR Cloud](https://help.splunk.com/en/help.splunk.com/en/?resourceId=soar_cloud)
* [App for SOAR](https://help.splunk.com/en/help.splunk.com/en/?resourceId=soar_app)
* [App for SOAR Export](https://help.splunk.com/en/help.splunk.com/en/?resourceId=SOARExport_UserGuide_ReleaseNotes)
* [Automation Broker](https://help.splunk.com/en/help.splunk.com/en/?resourceId=AutomationBroker_AutomationBroker_Enhancements)
RELATED APPS
* [Attack Analyzer](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_attack_analyzer)
* [Asset and Risk Intelligence](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_asset_risk)
* [App for PCI Compliance](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_pci)
* [App for Fraud Analytics](https://help.splunk.com/en/help.splunk.com/en/?resourceId=FraudAnalytics_UserGuide_Overview)
* [InfoSec App](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ent_info_sec)
* [Security Essentials](https://help.splunk.com/en/help.splunk.com/en/?resourceId=es_essentials)
Prevent disruptions and optimize operations when you monitor and analyze your IT service with predictive analytics and machine learning.
Release Notes ## Content Packs
Collect, index, and visualize your data in the cloud for better operational intelligence.
Release Notes
ITSI
* [Event Analytics](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ITSI_EA_AboutEA)
* [Entity Integration](https://help.splunk.com/en/?resourceId=ITSI_Entity_About)
* [Modules](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ITSI_IModules_AboutITSIModules)
* [REST APIs](https://help.splunk.com/en/?resourceId=ITSI_RESTAPI_ITSIRESTAPIreference)
* [Service Insights](https://help.splunk.com/en/help.splunk.com/en/?resourceId=ITSI_SI_AboutSI)
IT Ops
* [IT Essentials Work](https://help.splunk.com/en/help.splunk.com/en/?resourceId=itsi_ite_work)
* [IT Essentials Learn](https://help.splunk.com/en/help.splunk.com/en/?resourceId=itsi_learn)
ADMINISTRATION
* [IT Service Intelligence](https://help.splunk.com/en/?resourceId=ITSI_Configure_Abouttheproduct)
* [IT Essentials Work](https://help.splunk.com/en/help.splunk.com/en/?resourceId=itsi_ite_work)
* [Configuration File Reference](https://help.splunk.com/en/?resourceId=Splunk_Admin_Confreference)
EXTENSIONS
* [SAP Solutions](https://help.splunk.com/en/help.splunk.com/en/?resourceId=SAP_Config_About)
* [Infrastructure Monitoring Add-On](https://help.splunk.com/en/?resourceId=SIMAddon_Install_Overview)
Gain end-to-end visibility, troubleshoot in real-time, and optimize performance across infrastructure, applications, and user interfaces.
Release Notes
MONITORING
* [Alerts and Detectors](https://help.splunk.com/en/?resourceId=alerts-detectors-notifications_alerts-and-detectors_alerts-detectors-notifications)
* [Application Performance Monitoring](https://help.splunk.com/en/help.splunk.com/en/?resourceId=apm_intro-to-apm)
* [Infrastructure Monitoring](https://help.splunk.com/en/help.splunk.com/en/?resourceId=infrastructure_intro-to-infrastructure)
* [Digital Experience Monitoring](https://help.splunk.com/en/?resourceId=observability_cloud_EUM)
* [Observability Cloud for Mobile](https://help.splunk.com/en/help.splunk.com/en/?resourceId=observability_cloud_mobile)
* [On-Call](https://help.splunk.com/en/help.splunk.com/en/?resourceId=on_call)
DATA MANAGEMENT
* [AI Assistant](https://help.splunk.com/en/help.splunk.com/en/?resourceId=get-started_ai_assistant_in_observability_cloud)
* [Dashboards and Charts](https://help.splunk.com/en/help.splunk.com/en/?resourceId=data-visualization_dashboards_dashboards)
* [Integrations](https://help.splunk.com/en/help.splunk.com/en/?resourceId=gdi_integrations-list)
* [Logs](https://help.splunk.com/en/help.splunk.com/en/?resourceId=logs_intro-to-logs)
* [Metrics](https://help.splunk.com/en/help.splunk.com/en/?resourceId=metrics-and-metadata_metrics-landing)
* [OpenTelemetry Collector](https://help.splunk.com/en/help.splunk.com/en/?resourceId=gdi_opentelemetry_opentelemetry)
* [SignalFlow Analytics](https://help.splunk.com/en/?resourceId=analytics_signalflow-analytics-intro)
* [Search Reference](https://help.splunk.com/en/help.splunk.com/en/?resourceId=metrics-and-metadata_search)
ADMINISTRATION
* [Organization Management](https://help.splunk.com/en/help.splunk.com/en/?resourceId=admin_admin)
* [App Development](https://dev.splunk.com/observability/docs/)
* [API Reference](https://dev.splunk.com/observability/reference/)
Cloud-based application performance monitoring with AI-powered insights for hybrid and multi-cloud environments.
Release Notes ## AppDynamics On-Premises
Self-hosted application observability for regulated and sensitive environments.
Release Notes ## Virtual Appliance (Self-Hosted)
Pre-packaged, self-contained application monitoring solution based on modern Kubernetes architecture.
Release Notes
ESSENTIALS
* [Alert and Respond](https://help.splunk.com/en/?resourceId=alert-and-respond-485261580)
* [Agent Management](https://help.splunk.com/en/help.splunk.com/en/?resourceId=agent-management-485265069)
* [Dashboards and Reports](https://help.splunk.com/en/help.splunk.com/en/?resourceId=dashboards-and-reports-485261942)
* [Extensions](https://help.splunk.com/en/help.splunk.com/en/?resourceId=extend-appdynamics-485267042)
* [Licensing](https://help.splunk.com/en/help.splunk.com/en/?resourceId=appdynamics-licensing-513194409)
* [Tag Management](https://help.splunk.com/en/help.splunk.com/en/?resourceId=concept-53bfbd4b-f661-4f1c-a2b0-050232a84e6b)
MONITORING
* [Analytics](https://help.splunk.com/en/?resourceId=analytics-485264462)
* [Application Security Monitoring](https://help.splunk.com/en/?resourceId=application-security-monitoring-485265135)
* [Application Performance Monitoring](https://help.splunk.com/en/help.splunk.com/en/?resourceId=application-monitoring-485262182)
* [Database Visibility](https://help.splunk.com/en/help.splunk.com/en/?resourceId=database-visibility-485263541)
* [End User Monitoring](https://help.splunk.com/en/help.splunk.com/en/?resourceId=end-user-monitoring-485265386)
* [Infrastructure Visibility](https://help.splunk.com/en/help.splunk.com/en/?resourceId=infrastructure-visibility-485263833)
* [SAP Agent](https://help.splunk.com/en/help.splunk.com/en/?resourceId=sap_agent)
ADMINISTRATION
* [AppDynamics SaaS](https://help.splunk.com/en/help.splunk.com/en/?resourceId=appd_saas_accounts)
* [AppDynamics On-premises](https://help.splunk.com/en/help.splunk.com/en/?resourceId=appd_onprem_account)
Build and deliver apps and integrations with SDKs, APIs and tools. ## Splunkbase
Access and share apps and add-ons with the Splunk community on Splunkbase. Publish your own apps, or download and install others on your Splunk platform instance.
PLATFORM
* [Developer Guide](https://dev.splunk.com/enterprise/docs/welcome/)
* [REST APIs and Dev Tools](https://dev.splunk.com/enterprise/reference/)
* [Tutorials](https://dev.splunk.com/enterprise/tutorials/)
* [Downloads](https://dev.splunk.com/enterprise/downloads/)
* [Examples](https://dev.splunk.com/enterprise/examples/)
OBSERVABILITY
* [Developer Guide](https://dev.splunk.com/observability/docs/)
* [REST APIs](https://dev.splunk.com/observability/reference/)
REFERENCE
* [Python 3 Migration](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_Python3Migration_AboutMigration)
* [SOAR](https://help.splunk.com/en/?resourceId=concept-7e7dd9d8-a069-4cef-8780-fab1f46f5ce1)
* [SDK Reference](https://docs.splunk.com/Documentation/SDK)
* [UI Toolkit](https://help.splunk.com/en/dev.splunk.com/enterprise/docs/developapps/createapps/buildapps/)
Resources
Explore information on best practices, connect with community, or contact support.
REFERENCE
* [Configuration Files Reference](https://help.splunk.com/en/?resourceId=Splunk_Admin_Aboutconfigurationfiles)
* [REST APIs](https://help.splunk.com/en/?resourceId=ITSI_RESTAPI_ITSIRESTAPIreference)
* [SPL Reference](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_SearchReference_WhatsInThisManual)
* [Search Tutorial](https://help.splunk.com/en/help.splunk.com/en/?resourceId=Platform_SearchTutorial_WelcometotheSearchTutorial)
* [Validated Architectures](https://help.splunk.com/en/help.splunk.com/en/?resourceId=SVA_Architectures_About)
Learn More
* [Free Trials & Downloads](https://www.splunk.com/en_us/download.html)
* [Help Portal Release Notes](https://help.splunk.com/en/?resourceId=help_rn)
* [Splunk Community](https://community.splunk.com/)
* [Splunk Answers](https://community.splunk.com/t5/Find-Answers/ct-p/en-us-splunk-answers)
* [SPL 2 Reference](https://help.splunk.com/en/?resourceId=SCS_SearchReference_Introduction)
* [Splunk Lantern](https://lantern.splunk.com/)
Support
* [AppDynamics Support](https://www.splunk.com/en_us/customer-success/appdynamics-support.html)
* [Cisco Support](https://www.cisco.com/c/en/us/support/index.html)
* [Product Security Advisories](https://advisory.splunk.com/)
* [Splunk Support](https://www.splunk.com/en_us/customer-success/support-programs.html)
* [System Status](https://www.splunk.com/en_us/products/system-status.html)
Splunk Cloud Platform
Splunk Cloud Platform›MCP Server for Splunk Platform›MCP Server tools
MCP Server tools
The Splunk MCP Server provides several tools to interact with Splunk software.
Tool namespacing
Tools are namespaced based on their source. See the following table for prefix and source information:
| Prefix | Source |
|---|
splunk_ | Splunk core platform tools |
saia_ | Splunk AI Assistant tools |
o11y_ | Splunk Observability tools |
Note: Splunk platform tools are turned on by default.
The Splunk MCP server provides several tools to interact with Splunk software. See the following table for tool names and descriptions:
| Tool name | Description | Date added |
|---|
splunk_run_query | Execute a Splunk search query and return the results. This is the primary tool for running Splunk searches using Splunk Search Processing Language (SPL). Use this to retrieve log data, perform aggregations, analyze events, and extract insights from your Splunk environment. Version 1.3 and higher of MCP Server supports SPL2 as well as SPL searches. SPL2 runs with the same guardrails and includes the following commands: * fasearch * multireport * sdselect * return * timewrap * cluster The prefix of @spl2 is required, as shown in the following example: PYTHON Copy ```python @spl2 from index:_internal\n | stats count() as event_count Response -> 5092017 ``` For more information on SPL2 see theSPL2 Search Reference manual. Version 1.3 and higher offers workload management for the splunk_run_query tool. For more information see the Guardrail triggers and workload management for splunk_run_query section. |
splunk_get_info | Get comprehensive information about your Splunk instance. Retrieves system information including version, hardware specifications, and operational status. | July 2025 |
splunk_get_indexes | Get a list of indexes from Splunk. Indexes are data repositories where machine data is stored and organized. | July 2025 |
splunk_get_index_info | Get detailed information about a specific Splunk index. Returns comprehensive configuration and status information for the specified index. | July 2025 |
splunk_get_metadata | Retrieve metadata about hosts, sources, or sourcetypes across 1 or more indexes in the selected time window. | July 2025 |
splunk_get_user_info | Retrieves detailed information about the currently authenticated user including roles and permissions. Returns comprehensive user profile data for the current session. | July 2025 |
splunk_get_user_list | Get a list of users from Splunk. Retrieves information about all users including authentication details, roles, and account status. | July 2025 |
splunk_get_kv_store_collections | Get KV Store collection statistics including size, count, and storage information. Retrieves comprehensive metrics about all KV Store collections in the Splunk instance. | July 2025 |
splunk_get_knowledge_objects | Retrieve Splunk knowledge objects by type. Supports various knowledge object types including saved searches, alerts, field extractions, lookups, macros, and data models. Refer to the full list of supported types later in this topic. | July 2025 |
splunk_list_alerts | Lists alerts accessible to the current user, with optional filtering by app, enabled state, and severity. | September 2026 |
splunk_get_alert_details | Retrieves the configuration of a specified alert, including its search, schedule, trigger conditions, throttle configuration, notification actions, owner, and enabled state. | September 2026 |
splunk_list_fired_alerts | Lists active, unexpired fired alerts, with optional filtering by app and severity. | September 2026 |
splunk_get_fired_alert_details | Retrieves recent fired instances for a specified alert, including fire time and severity. | September 2026 |
splunk_get_alert_throttle | Retrieves the current throttle configuration and suppression state for a specified alert, including the suppression window and remaining time when active. | September 2026 |
splunk_list_active_throttles | Lists alerts that are currently suppressing notifications, including their suppression criteria, window duration, and remaining time. | September 2026 |
saia_find_data_source | Use natural language to surface the data you want searched, rather than searching all indexes. Results are presented as a shortlist, ranked by relevance. Note: To use saia_find_data_source, Agent Mode must be turned on in Splunk AI Assistant. Agent Mode requires Splunk Enterprise version 10.1.x or higher. To learn more, see Agent Mode in Splunk AI Assistant. Note: This tool was offered as a preview with MCP version 1.3. | July 2026 |
saia_generate_spl | Generate SPL from natural language searches using Splunk AI Assistant for SPL. | September 2025 |
saia_explain_spl | Explain SPL queries in natural language using Splunk AI Assistant for SPL. Converts complex SPL commands into human-readable explanations. | September 2025 |
saia_optimize_spl | Optimize SPL searches using Splunk AI Assistant for SPL. Improves search performance, efficiency, and follows best practices. | September 2025 |
saia_ask_splunk_question | Ask natural language questions about Splunk using Splunk AI Assistant for SPL. Get explanations about Splunk commands, concepts, features, and best practices. | September 2025 |
splunk_run_saved_search | Beta feature that lets AI assistants run your existing Splunk saved searches directly through MCP. See Beta feature: Run Saved Search. | April 2026 |
o11y_get_apm_services | Retrieves a list of APM services for a given environment. | September 2026 |
o11y_get_apm_environments | Gets a list of APM environments. | September 2026 |
o11y_get_apm_service_errors_and_requests | Provides a breakdown of service errors and requests by tag. | September 2026 |
o11y_get_apm_service_latency | Provides a breakdown of service latency by tag. | September 2026 |
o11y_get_apm_service_dependencies | Gets upstream and downstream service dependencies. | September 2026 |
o11y_get_apm_trace_tool | Returns trace errors and spans for a given trace ID. | September 2026 |
o11y_get_apm_exemplar_traces | Gets exemplar traces for a service. | September 2026 |
o11y_search_alerts_or_incidents | Retrieves alerts or incidents triggered by detectors. | September 2026 |
o11y_get_metric_names | Gets existing metric names by wildcard search | September 2026 |
o11y_get_metric_metadata | Retrieves dimensions and properties for given metrics. | September 2026 |
o11y_generate_signalflow_program | Generates a Splunk SignalFlow program from natural language. | September 2026 |
o11y_execute_signalflow_program | Executes a SignalFlow program and returns results. | September 2026 |
Guardrail triggers and workload management for splunk_run_query
The splunk_run_query tool is the primary tool for running Splunk searches using Splunk Search Processing Language (SPL) and SPL2.
Note: Support for SPL2 is available with version 1.3 and higher. When searching with SPL2 the
prefix of @spl2 is required.
Guardrail triggers
The splunk_run_query tool is intended for quick searches that are deemed safe and non-destructive. The tool might fail and trigger a guardrail for 1 or more of the following reasons:
- If the search contains commands that are deemed unsafe or destructive, the MCP server might not execute the search.
- The execution time exceeds 1 minute.
- The number of events in the response exceeds 1000.
Workload management
When running Splunk MCP Server version 1.3 and higher you can use workload management to create a workload pool for the splunk_run_query tool.
Workload management (WLM) can help allocate system resources among different workloads. Workload pools define how those resources are assigned. Taking this step moves splunk_run_query into a detached, asynchronous search job.
-
For detailed steps on creating workload pools in Splunk Enterprise see Configure workload pools in the Administer Splunk Enterprise manual.
-
Splunk Cloud Platform users can learn more about workload pools in Workload Management overview in the Administer Splunk Cloud Platform manual.
To use the workload pool call splunk_run_query with the exact pool identifier as shown in the following example:
JSON Copy
{
"method": "tools/call",
"params": {
"name": "splunk_run_query",
"arguments": {
"query": "| makeresults | eval marker=\"mcp_pool_probe\"",
"workload_pool": "mcp_low_priority"
}
}
}
Supported knowledge object types
The following knowledge object types are supported by get_knowledge_objects:
-
saved_searches
-
alerts
-
field_extractions
-
field_aliases
-
calculated_fields
-
lookups
-
automatic_lookups
-
lookup_transforms
-
macros
-
tags
-
data_models
-
workflow_actions
-
views
-
panels
-
apps
-
mltk_models
-
mltk_algorithms
Share this page
Share feedback about this page Share feedback
Previous Connecting to the MCP Server and settingsNext Managing custom tools in Splunk MCP Server
Latest 2.0
Ask ChatGPT about this page Ask Claude about this page
Download Topic Download Manual
ON THIS PAGE
©2005-2026 Splunk Inc. All rights reserved.
LegalPrivacyWebsiteTerms of Use
By continuing to use our website, you acknowledge the use of cookies.
Privacy StatementChange Settings
Consent Manager
Your opt out preference signal is honored.
Consent Manager
-
Your Privacy
-
Strictly Necessary Cookies
-
Performance Cookies
-
Targeting Cookies
-
Functional Cookies
Your Privacy
When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. From the list on left, please choose whether this site may use Performance and/or Targeting Cookies. By selecting Strictly Necessary Cookies only, you are requesting Cisco not to sell or share your personal data. Note, blocking some types of cookies may impact your experience on the site and the services we are able to offer.
Strictly Necessary Cookies
Always Active
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
Cookies Details
Performance Cookies
These cookies provide metrics related to the performance and usability of our site. They are primarily focused on gathering information about how you interact with our site, including: page load times, response times, error messages, and allowing a replay of a visitor’s interactions with our site, which enables us to review and analyze visitor behavior, helping to improve site usability and functionality. These cookies also allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. If you do not allow these cookies we will not know when you have visited our site and will not be able to monitor its performance.
Cookies Details
Targeting Cookies
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Cookies Details
Functional Cookies
These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.
Cookies Details
Cookie List
Consent Leg.Interest
Clear
Apply Cancel
Save Settings
Allow All