Splunk MCP

🚀 Splunk MCP Framework Usage Guide

This guide provides a comprehensive overview of the Splunk MCP framework, including installation steps, operation modes, configuration parameter explanations, usage examples, troubleshooting tips, integration with Claude Desktop, and testing guidelines.

🚀 Quick Start

Before using the Splunk MCP framework, ensure you have installed the necessary dependencies and configured the relevant files. The following sections will guide you through the installation and configuration process.

📦 Installation

1. Install Dependencies

Run the following command to install the required dependencies:

pip install python-splunk-sdk python-decouple starlette asyncstdlib

2. Configuration File

Create and edit the configuration file config.ini and fill in the following information:

[SPLUNK]
host = Your Splunk host address
port = Port, default is 8089
username = Splunk username
password = Splunk password
scheme = Protocol, optional values are http or https, default is https
verify_ssl = Whether to verify the SSL certificate, values are true or false

[MCP]
mode = Mode, optional values are sae or stdio, default is sae
port = The port that the MCP service listens on, default is 8001

✨ Features

Operation Modes

1. SSE Mode (Recommended for Production Environments)

poetry run python splunk_mcp.py sae

• After startup, you can connect through the /sse interface to receive real-time event streams.

2. STDIO Mode (Suitable for Development and Testing)

poetry run python splunk_mcp.py stdio

• Input query commands and output results:

  $ poetry run python splunk_mcp.py stdio
  > |indices
  {
    "result": [
      "default",
      "index_1",
      "search"
    ],
    "success": true,
    "message": ""
  }
  

Configuration Parameter Explanations

Basic Configuration

• host: Splunk HEC address, default is localhost
• port: Listening port, default is 8001
• mode: Operation mode, optional values are sae or stdio

Log Configuration

• log_level: Log level, default is info
• log_file: Log file path, if not set, output to the console

💻 Usage Examples

1. List Available Indices

$ poetry run python splunk_mcp.py stdio
> |indices
{
    "result": [
        "default",
        "index_1",
        "search"
    ],
    "success": true,
    "message": ""
}

2. Search for Events

$ poetry run python splunk_mcp.py stdio
> search index=_internal | stats count
{
    "result": [
        {
            "count": 12345
        }
    ],
    "success": true,
    "message": ""
}

🔧 Troubleshooting

Connection Issues

• Check network connectivity and ensure that the Splunk service is started and the port is open.
• View the log file to obtain more error information.

Authentication Issues

• Confirm that the username and password are correct.
• Check if the user permissions are sufficient.

📚 Integration with Claude Desktop

Edit the Claude configuration file claude_desktop_config.json and add the following content:

{
    "splunk": {
        "host": "localhost",
        "port": 8089,
        "username": "admin",
        "password": "password",
        "mode": "stdio"
    }
}

📚 Testing Guidelines

Unit Tests

Run the following command to execute unit tests:

pytest tests/

Integration Tests

Run end-to-end tests in the integration environment to ensure that all modules work together properly.

📚 Summary

This framework provides flexible configuration options and multiple operation modes, suitable for different usage scenarios. You can quickly connect to the Splunk service through simple configuration and support seamless integration with Claude Desktop. For more help, please refer to the official documentation or contact the technical support team.