Embarking on the Splunk AI Journey with LLM and MCP

21-05-2026

Embarking on the Splunk AI Journey with LLM and MCP

We generate more data every day, but understanding it remains the real challenge. The increase in LLM usage across domains is making it easier to see through the Big Data in our daily lives. But relying on prompting with vague assumptions still does not give us the exact outcome we are looking for.

In Splunk, data often isn’t fully integrated with LLMs, making prompt-based results difficult. And for beginners, figuring out SPL can still feel like a nightmare.

Worried about writing SPL, creating reports and figuring out insights?

Not anymore!

The Splunk Model Context Protocol, also known as the Splunk MCP server, is available for both Splunk Enterprise and Splunk Cloud. It lets you easily integrate your LLM and safely search for insights from data or create AI-based use cases to decide what needs to be done. It can also provide you with a detailed summary that includes the insights and the next action to be taken.

AI uses your natural language to accomplish all these tasks. Splunk Search Processing Language (SPL) expertise is not required of anyone present.

Are you still worried about the manual action part of what to do next?

Splunk has got you covered here as well. By connecting to Atlassian’s Remote MCP Server, you can assess scenarios and manage incidents within a single prompt, all by interacting with your AI buddy.

One of the use cases could be automating Alert investigations on Confluence for generated results from a query.

There are tools integrated with Splunk MCP Server that do the task and are listed below for your reference:

- - generate_spl: Use to generate SPL queries from natural language prompts.
  - explain_spl: Convert complex SPL queries into plain English to understand what a query does.
  - optimize_spl: Automatically optimize SPL queries.
  - ask_splunk_question: Ask questions about Splunk concepts and more in natural language.
  - run_splunk_query: Run SPL queries in Splunk to search logs, aggregate data, analyze events, and extract insights.
  - get_splunk_info: Get system-level information about your Splunk instance.
  - get_indexes: List all indexes in Splunk.
  - get_index_info: Get detailed information on a specific Splunk index.
  - get_metadata: Retrieve metadata about hosts, sources, or source types.
  - get_user_info: Get information about the current user and session details.
  - get_user_list: Fetch a complete list of users in Splunk along with authentication details.
  - get_kv_store_collections: Display statistics about KV Store collections.
  - get_knowledge_objects: Access different knowledge objects in the Splunk Environment.

Get started, follow this step-by-step approach:

- - Ensure that the prerequisites, such as software dependencies and system settings, are properly configured in the environment, noting that requirements may vary depending on the operating system.
  - Coordinate with Splunk administrators to set up the user accounts, focusing on authentication and authorization for users with the Splunk MCP server.
  - Connect your Splunk MCP server to your desired MCP-compatible AI client to enable seamless data integration and analysis.