Connectors · Developer & infrastructure
Splunk Platform MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Splunk Platform and the rest of your systems. It gives your agent 629 Splunk Platform actions (328 reads, 218 writes and 83 that wait for a confirmation) and holds the Splunk Platform credential itself, so the agent never does. It paces Splunk Platform's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "splunk_platform.users.list", intent: "check which Splunk Platform account is connected"}# List current users · read · 1 upstream call- 629actionsin one signed file
- 328readlook, never change
- 218writecreate and update
- 83wait for a yesdestructive, confirmed first
Set up
Connect Splunk Platform in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Splunk Platform.
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
tokenSplunk authentication token (Settings > Tokens, or authorization/tokens)hostWhere your Splunk Platform lives: your host
account { op: "connections.requirements", service: "splunk_platform" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "splunk_platform.users.list" }# list current users · read · 1 upstream callcheck { action: "splunk_platform.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Splunk Platform at a glance
- Sign-in
- Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
token- Setup fields
host- Limits we pace to
- 300 calls a minute, per connection
- API covered
- Splunk Enterprise REST API reference 10.6 (also Splunk Cloud Platform), plus the SPL2 orchestrator API, at your Splunk Platform instance's API base URL, which you enter when connecting
- Built from
- Splunk Platform's documentation, read 22 October 2026help.splunk.comhelp.splunk.comhelp.splunk.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 314 of 328 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 5, so ask can line Splunk Platform up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Splunk Platform.
629 actions in 18 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 328readlook, never change
- 218writecreate and update
- 83destructivewait for a confirmation
Input
9344 read · 35 write · 14 destructive
Creates and configures the S3 destination · Gets list of the s3 destination configuration values · Creates and updates a ruleset · Return a list of your deployed rulesets
Access
8734 read · 37 write · 16 destructive
List current users · List all roles and the permissions for each role · Get user information for the current context · Create a user
Knowledge
8138 read · 30 write · 13 destructive
Access all the XML definitions for existing dashboards · Create a new dashboard source XML definition · Access an existing dashboard XML definition · Update a specific dashboard XML definition
Cluster
7841 read · 27 write · 10 destructive
List cluster node configuration · List cluster node configuration · Add this bucket to the fix list · List cluster manager node bucket configuration
Search
5231 read · 16 write · 5 destructive
Access a fired alerts summary · Access saved search configurations · List unexpired triggered instances of this alert · Create a saved search
Introspection
4639 read · 5 write · 2 destructive
List the Splunk deployment volumes · Create a new index · List the recognized indexes on the server · List bucket attributes for all indexes
Deployment
3019 read · 9 write · 2 destructive
Get deployment client list with enabled status, server class, and host and port number of each · Get deployment client enabled status, server class for app distribution, and host and port number · Get deployment client disabled status · List distributed apps, including distributed state information
KV store
229 read · 10 write · 3 destructive
Create a KV Store backup archive file · Create a collection · List all collections · Perform multiple queries in a batch
10 more areas · 140 actions
- Output 21
- License 20
- Federated search 17
- System 17
- Configuration 15
- Workload management 15
- Application 11
- SPL2 11
- Metrics catalog 8
- Topology 5
Top actions
The Splunk Platform API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 25 of Splunk Platform's 26 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
splunk_platform.users.listList current users | List current users. | read | identity.user.list474 connectors |
splunk_platform.roles.listList all roles and the permissions for each role | List all roles and the permissions for each role. | read | identity.role.list184 connectors |
splunk_platform.current_context.listGet user information for the current context | Get user information for the current context. | read | identity.current_user.get307 connectors |
splunk_platform.users.createCreate a user | Create a user. | write | identity.user.create262 connectors |
splunk_platform.roles.createCreate a user role | Create a user role. | write | identity.role.create105 connectors |
splunk_platform.fired_alerts.listAccess a fired alerts summary | Access a fired alerts summary. | read | monitoring.alert.list51 connectors |
splunk_platform.users.deleteRemove the specified user from the system | Remove the specified user from the system. | destructive | identity.user.delete253 connectors |
splunk_platform.saved_searches.listAccess saved search configurations | Access saved search configurations. | read | analytics.saved_query.list10 connectors |
splunk_platform.tokens.listList information on tokens | List information on tokens. | read | identity.api_key.list96 connectors |
splunk_platform.views.listAccess all the XML definitions for existing dashboards | Access all the XML definitions for existing dashboards. | read | analytics.dashboard.list22 connectors |
splunk_platform.views.createCreate a new dashboard source XML definition | Create a new dashboard source XML definition. | write | analytics.dashboard.create18 connectors |
splunk_platform.saved_searches.createCreate a saved search | Create a saved search. | write | analytics.saved_query.create8 connectors |
Try it
Prompts to paste into Claude.
Each one names the Splunk Platform actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Which Splunk Platform alerts are open right now? Group them by service.
calls
splunk_platform.fired_alerts.list - Writewrite
Create a user in Splunk Platform. Show me exactly what you will send before you save it.
calls
splunk_platform.users.create
Governance for Splunk Platform
Destructive actions wait for a yes.
83 Splunk Platform actions are destructive. The first 10:
- Remove the specified user from the system
splunk_platform.users.delete - Delete the specified role
splunk_platform.roles.delete - Delete a specific dashboard
splunk_platform.views.delete - Delete the named saved search
splunk_platform.saved_searches.delete - Delete a token for the specified user
splunk_platform.tokens.delete - Delete the specified message
splunk_platform.messages.delete - Delete the {name} app
splunk_platform.apps_local.delete - Delete the {search_id} search job
splunk_platform.search_jobs.delete - Delete the tag and its associated field:value pair assignments
splunk_platform.search_tags.delete - Removes the {name} index and the data contained in it
splunk_platform.data_indexes.delete
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Remove the specified user from the system?
intent: the user asked me to remove the specified user from the system
account { op: "keys.create", name: "splunk-platform-agent", allowed_actions: ["splunk_platform.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "splunk_platform.users.delete", approver: "[email protected]" }, { match: "splunk_platform.roles.delete", approver: "[email protected]" }, { match: "splunk_platform.views.delete", approver: "[email protected]" } ]}Cost
What Splunk Platform costs on actionlake.
Every Splunk Platform action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Splunk Platform refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 629 Splunk Platform actions
- 629actions pageeach page of a long list is one call
- 314reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Splunk Platform action.
629 actions by area: the id your agent calls, what it does, and its effect.
Input93
splunk_platform.data_ingest_rfsdestinations.createCreates and configures the S3 destinationwritesplunk_platform.data_ingest_rfsdestinations.listGets list of the s3 destination configuration valuesreadsplunk_platform.data_ingest_rulesets.createCreates and updates a rulesetwritesplunk_platform.data_ingest_rulesets.listReturn a list of your deployed rulesetsreadsplunk_platform.data_ingest_rfsdestinations.deleteDeletes the S3 destinationdestructivesplunk_platform.data_ingest_rulesets.getReturn a named deployed rulesetread- and 87 more in this area
Access87
splunk_platform.current_context.listGet user information for the current contextreadsplunk_platform.roles.listList all roles and the permissions for each rolereadsplunk_platform.users.createCreate a userwritesplunk_platform.users.listList current usersreadsplunk_platform.admin.replicate_saml_certsUsage details After editing SAML IdP certificate files in $SPLUNK_HOME/etc/auth/idpCerts on one node in the cluster, yo…writesplunk_platform.admin_duo_mfa.createCreate a Duo Multifactor configurationwrite- and 81 more in this area
Knowledge81
splunk_platform.views.createCreate a new dashboard source XML definitionwritesplunk_platform.views.getAccess an existing dashboard XML definitionreadsplunk_platform.views.listAccess all the XML definitions for existing dashboardsreadsplunk_platform.views.updateUpdate a specific dashboard XML definitionwritesplunk_platform.admin_summarization.getGet detailed information about the acceleration summaries of a specific datamodelreadsplunk_platform.admin_summarization.listGet a list of field:value pairs that provide details about accelerated data models and their summariesread- and 75 more in this area
Cluster78
splunk_platform.cluster_config.listList cluster node configurationreadsplunk_platform.cluster_config_config.listList cluster node configurationreadsplunk_platform.cluster_manager_buckets.fixAdd this bucket to the fix listwritesplunk_platform.cluster_manager_buckets.listList cluster manager node bucket configurationreadsplunk_platform.cluster_config_config.updateManage configuration detailswritesplunk_platform.cluster_manager_buckets.fix_corrupt_bucketTrigger a corruption fixup for this bucketdestructive- and 72 more in this area
Search52
splunk_platform.fired_alerts.getList unexpired triggered instances of this alertreadsplunk_platform.fired_alerts.listAccess a fired alerts summaryreadsplunk_platform.saved_searches.createCreate a saved searchwritesplunk_platform.saved_searches.listAccess saved search configurationsreadsplunk_platform.alerts_alert_actions.listAccess a list of alert actionsreadsplunk_platform.alerts_metric_alerts.createCreate a streaming metric alertwrite- and 46 more in this area
Introspection46
splunk_platform.data_index_volumes.listList the Splunk deployment volumesreadsplunk_platform.data_indexes.createCreate a new indexwritesplunk_platform.data_indexes.listList the recognized indexes on the serverreadsplunk_platform.data_indexes_extended.listList bucket attributes for all indexesreadsplunk_platform.data_index_volumes.getList {name} volume propertiesreadsplunk_platform.data_indexes.deleteRemoves the {name} index and the data contained in itdestructive- and 40 more in this area
Deployment30
splunk_platform.deployment_client.listGet deployment client list with enabled status, server class, and host and port number of eachreadsplunk_platform.deployment_client_config.listGet deployment client enabled status, server class for app distribution, and host and port numberreadsplunk_platform.deployment_client_config_list_is_disabled.listGet deployment client disabled statusreadsplunk_platform.deployment_server_applications.listList distributed apps, including distributed state informationreadsplunk_platform.deployment_client.reloadRestart and reload {name} deployment clientwritesplunk_platform.deployment_client_config.reloadAccess client reload informationwrite- and 24 more in this area
KV store22
splunk_platform.kvstore_backup.createCreate a KV Store backup archive filewritesplunk_platform.kvstore_collections.createCreate a collectionwritesplunk_platform.kvstore_collections.listList all collectionsreadsplunk_platform.kvstore_data.batch_find_postPerform multiple queries in a batchreadsplunk_platform.kvstore_backup.restoreExtracts the KV Store backup archive file and restores the KV Storewritesplunk_platform.kvstore_collections.deleteDelete a specific {collection} destructive- and 16 more in this area
Output21
splunk_platform.data_outputs_tcp_default.createConfigure global tcpout propertieswritesplunk_platform.data_outputs_tcp_default.listReturns the current tcpout propertiesreadsplunk_platform.data_outputs_tcp_group.createConfigure a group of one or more data forwarding destinationswritesplunk_platform.data_outputs_tcp_group.listGet configuration information about target groupsreadsplunk_platform.data_outputs_tcp_default.deleteDisable the default forwarding settingsdestructivesplunk_platform.data_outputs_tcp_default.getRetrieve the named configurationread- and 15 more in this area
License20
splunk_platform.licenser_groups.listLists all licenser groupsreadsplunk_platform.licenser_licenses.createAdd a license entitlement to the current instancewritesplunk_platform.licenser_licenses.listList all licenses addedreadsplunk_platform.licenser_localpeer.listGet license state information for the Splunk instancereadsplunk_platform.licenser_groups.getList a specific licenser groupreadsplunk_platform.licenser_groups.updateActivate a specific licenser group and deactivate the previously active onewrite- and 14 more in this area
Federated search17
splunk_platform.data_federated_index.createCreates a new federated index definitionwritesplunk_platform.data_federated_index.listReturns a list of federated indexesreadsplunk_platform.data_federated_provider.createCreates a new federated provider definitionwritesplunk_platform.data_federated_provider.listReturns a list of federated providersreadsplunk_platform.data_federated_index.deleteDeletes a definition for a specific {federated_index_name}destructivesplunk_platform.data_federated_index.disableTurn off a specific federated indexwrite- and 11 more in this area
System17
splunk_platform.messages.createCreate a persistent message displayed at /services/messageswritesplunk_platform.messages.listShow systemwide messagesreadsplunk_platform.server_control.listList actions that can be performed at this endpointreadsplunk_platform.server_httpsettings.proxysettingsCreate an HTTP Proxy server configuration stanza for use with splunkdwritesplunk_platform.messages.deleteDelete the specified messagedestructivesplunk_platform.messages.getGet details of the specified messageread- and 11 more in this area
Configuration15
splunk_platform.configs.createAdd stanza to {file} configuration filewritesplunk_platform.configs.listList {file} configuration file stanzasreadsplunk_platform.properties.create_fileCreate a configuration filewritesplunk_platform.properties.create_stanzaAdd stanza to {file} configuration file or validate the entire configuration filewritesplunk_platform.configs_stanza.deleteDelete {stanza} in {file} configuration filedestructivesplunk_platform.configs_stanza.getGet {stanza} in {file} configuration fileread- and 9 more in this area
Workload management15
splunk_platform.workloads_categories.listList information about workload categoriesreadsplunk_platform.workloads_config_get_base_dirname.listGet the name of the splunk parent cgroupreadsplunk_platform.workloads_config_preflight_checks.listRun Linux preflight checks for workload managementreadsplunk_platform.workloads_policy_search_admission_control.listList the enabled status of admission rulesreadsplunk_platform.workloads_categories.updateEdit workload categorieswritesplunk_platform.workloads_config.disableDisable workload managementwrite- and 9 more in this area
Application11
splunk_platform.apps.appinstallInstall or update an application from a local file or URLwritesplunk_platform.apps_apptemplates.listList installed app templatesreadsplunk_platform.apps_local.check_updateGet {name} app eai:acl informationreadsplunk_platform.apps_local.createCreate an appwritesplunk_platform.apps_apptemplates.getGet the {name} app template descriptorreadsplunk_platform.apps_local.deleteDelete the {name} appdestructive- and 5 more in this area
SPL211
splunk_platform.spl2.convertConverts an SPL search into an SPL2readsplunk_platform.spl2.convert_v2Converts an SPL search into SPL2 and returns any warnings or errors that occurred as a result of the conversionreadsplunk_platform.spl2_datasets.listList all datasetsreadsplunk_platform.spl2_modules.dispatchStart one or more new searches and return a search ID (SID) for each named search statementwritesplunk_platform.spl2_datasets.getGet a dataset by ID or resource namereadsplunk_platform.spl2_module_permissions.getRetrieve all of the permissions for a moduleread- and 5 more in this area
Metrics catalog8
splunk_platform.catalog_metricstore_dimensions.listReturns dimension names for a given metricreadsplunk_platform.catalog_metricstore_dimensions.valuesReturns values of a {dimension-name} for a given metricreadsplunk_platform.catalog_metricstore_metrics.listReturns metric namesreadsplunk_platform.catalog_metricstore_rollup.createCreates rollup policies for a specified metric indexwritesplunk_platform.catalog_metricstore_rollup.deleteDeletes a rollup policy for a specific source {index} destructivesplunk_platform.catalog_metricstore_rollup.getReturns a list of the rollup summaries associated with a specific source {index} read- and 2 more in this area
Topology5
splunk_platform.stack_explainer_v1_node_identity.getRetrieves identity information for a remote Splunk platform node identified by its {guid} readsplunk_platform.stack_explainer_v1_node_identity.listRetrieves identity information for the local Splunk platform nodereadsplunk_platform.stack_explainer_v1_topology.listRetrieves a complete view of the deployment topology for the Splunk platformreadsplunk_platform.stack_explainer_v1_trusted_connections.listRetrieves configuration settings for the trusted connections of the local node, including HEC, S2S, and search peer rel…readsplunk_platform.stack_explainer_v1_trusted_connections.getRetrieves configuration settings for the trusted connections of the remote node, identified by {guid} , including HEC,…read
This index shows a sample of each area. All 629 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The Splunk Platform MCP server, answered.
Is there a Splunk Platform MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 629 Splunk Platform actions across input, access, knowledge and cluster, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Splunk Platform.
What do I need to connect Splunk Platform?
Splunk authentication token (Settings > Tokens, or authorization/tokens). Plus your host. The free call account { op: "connections.requirements", service: "splunk_platform" } lists exactly what to paste.
Can an AI agent delete or change things in Splunk Platform?
Only if its key allows it, and only with an explicit confirmation. 83 Splunk Platform actions are destructive, including remove the specified user from the system, delete the specified role and delete a specific dashboard. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Splunk Platform API limit?
actionlake paces every call to the limits in the Splunk Platform service file: 300 calls a minute per connection. Repeated reads are answered from cache (314 Splunk Platform actions can be), which never reaches Splunk Platform.
What does a Splunk Platform action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (629 Splunk Platform actions page). Cache hits, searches, dry runs and calls Splunk Platform refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Splunk Platform API does it cover?
The Splunk Enterprise REST API reference 10.6 (also Splunk Cloud Platform), plus the SPL2 orchestrator API at your Splunk Platform instance's API base URL, which you enter when connecting. It is built from Splunk Platform's documentation as read on 22 October 2026. 629 actions in 18 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Splunk Platform data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Splunk Platform credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Splunk Platform today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
