Golang Splunk MCP Server — Searches, Alerts, Indexes, Macros

Overview

This Golang MCP (Model Context Protocol) server provides a lightweight adapter for managing Splunk saved searches, alerts, indexes, and macros from external automation or LLM tooling. It exposes Splunk management operations as tools that can be invoked over two transport modes: Server-Sent Events (SSE) for HTTP integrations and STDIO for running as a subprocess. The server acts as a bridge between automated agents (or developer scripts) and the Splunk REST management API, simplifying programmatic creation, updates, deletion, and inspection of saved objects.

For developers building integrations, orchestration pipelines, or AI agents that need to interact with Splunk at a higher level, the server packages common Splunk operations into a consistent MCP interface. This reduces the amount of glue code required to authenticate with Splunk, normalize payloads, and handle streaming or synchronous invocation semantics.

Features

• Manage Splunk saved searches and their alerting behavior (create, update, delete, list).
• Create and manage Splunk alerts (enable/disable, configure actions).
• Create and manage Splunk indexes (create, check status, delete).
• Create and manage Splunk search macros.
• Two transport modes:
  • SSE (HTTP Server-Sent Events) for remote or web-based tool integrations.
  • STDIO mode for running as a local subprocess (suitable for LLM tool runners).
• Simple configuration via environment variables or CLI flags.
• Lightweight Go binary with no heavy dependencies.

Installation / Configuration

Build from source (requires Go 1.18+):

git clone https://github.com/jkosik/mcp-server-splunk.git
cd mcp-server-splunk
go build -o mcp-server-splunk ./cmd/mcp-server-splunk

Run the server, pointing it to your Splunk management endpoint. Typical configuration is via environment variables:

• SPLUNK_BASE_URL — Splunk management endpoint, e.g. https://splunk.example.com:8089
• SPLUNK_TOKEN — Management API token (Authorization: Bearer …)
• MCP_ADDR — Optional address for SSE mode (default :8080)
• LOG_LEVEL — set logging verbosity (info, debug, warn)

Example (SSE mode):

export SPLUNK_BASE_URL="https://splunk.example.com:8089"
export SPLUNK_TOKEN="your-splunk-token"
./mcp-server-splunk --addr :8080

Example (STDIO mode):

export SPLUNK_BASE_URL="https://splunk.example.com:8089"
export SPLUNK_TOKEN="your-splunk-token"
./mcp-server-splunk --stdio

Docker example:

docker run -e SPLUNK_BASE_URL=https://splunk.example.com:8089 \
           -e SPLUNK_TOKEN=your-splunk-token \
           -p 8080:8080 \
           ghcr.io/your-repo/mcp-server-splunk:latest

Notes:

• Ensure TLS trust configured for Splunk’s certificate (or use a trusted certificate).
• The server uses the Splunk REST management APIs; the supplied token must have appropriate capabilities.

Available Resources

The server exposes a set of logical tools/resources that map to common Splunk management objects. Each resource supports typical CRUD-like operations and some management actions.

Transport behavior:

• SSE: Use HTTP requests to the server; responses and progress are emitted as Server-Sent Events (text/event-stream). Useful for web UIs or remote orchestrators.
• STDIO: The binary reads/writes JSON MCP frames on stdin/stdout and is usable as an LLM tool process in systems that use STDIO-based tools.

Example payload (create saved search):

{
  "name": "my_saved_search",
  "search": "index=main | stats count by host",
  "cron_schedule": "0 * * * *",
  "is_scheduled": true,
  "alert_type": "number of events",
  "alert_threshold": 0
}

Use Cases

• Continuous Security Automation: An orchestration engine detects an anomalous pattern and uses this server to create or enable a saved search that triggers alerts and runs investigate workflows.
• LLM-driven Operations: An LLM tool-runner uses the STDIO mode to ask the server to list indexes and create a macro used by subsequent generated searches.
• Onboarding / Scripting: SREs or Splunk administrators use the SSE endpoint to programmatically provision indexes and saved searches as part of environment bootstrap scripts.
• Alert Management: A monitoring dashboard calls the server to update alert actions or enable/disable alerting rules across environments in a consistent way.

Examples

1. Create a saved search via SSE (example HTTP POST):

curl -X POST "http://localhost:8080/tools/saved_searches/create" \
  -H "Content-Type: application/json" \
  -d '{"name":"daily-summary","search":"index=main | stats count","cron_schedule":"0 0 * * *","is_scheduled":true}'

2. Run as a subprocess from an agent (STDIO): start binary with –stdio and send MCP JSON frames over stdin; read responses from stdout. This is suitable for tool-runner frameworks that spawn helper tools.

Resources & Links

• GitHub repository: https://github.com/jkosik/mcp-server-splunk
• Splunk REST API docs (for reference): https://docs.splunk.com/Documentation/Splunk/latest/RESTTUT

If you need to extend the server (add custom tools or resource handlers), the code is written in Go and organized to make adding new handlers straightforward. Check the repository for examples and handler patterns.