--- title: "Splunk Platform MCP server for AI agents - actionlake" description: "Give Claude 629 Splunk Platform actions through one MCP server: input, access, knowledge. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/splunk-platform updated: 2026-10-22 --- Connectors · Developer & infrastructure # Splunk Platform MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Splunk Platform and the rest of your systems. It gives your agent 629 Splunk Platform actions (328 reads, 218 writes and 83 that wait for a confirmation) and holds the Splunk Platform credential itself, so the agent never does. It paces Splunk Platform's limits and records every call. [Connect Splunk Platform free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "splunk_platform.users.list", intent: "check which Splunk Platform account is connected" } # List current users · read · 1 upstream call ``` - 629 actions in one signed file - 328 read look, never change - 218 write create and update - 83 wait for a yes destructive, confirmed first Set up ## Connect Splunk Platform in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Splunk Platform. Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `token` Splunk authentication token (Settings > Tokens, or authorization/tokens) - `host` Where your Splunk Platform lives: your host ``` account { op: "connections.requirements", service: "splunk_platform" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "splunk_platform.users.list" } # list current users · read · 1 upstream call check { action: "splunk_platform.users.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Splunk Platform at a glance **Sign-in** Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `token` **Setup fields** `host` **Limits we pace to** 300 calls a minute, per connection **API covered** Splunk Enterprise REST API reference 10.6 (also Splunk Cloud Platform), plus the SPL2 orchestrator API, at your Splunk Platform instance's API base URL, which you enter when connecting **Built from** Splunk Platform's documentation, read 22 October 2026[help.splunk.com](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.6/introduction/endpoints-reference-list) [help.splunk.com](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.6/search-endpoints/search-endpoint-descriptions) [help.splunk.com](https://help.splunk.com/api/api-specification/5ff79987-5679-4fd6-a5b2-894202c21788) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 314 of 328 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 5, so ask can line Splunk Platform up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Splunk Platform. 629 actions in 18 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **328** read look, never change - **218** write create and update - **83** destructive wait for a confirmation 1. ### Input 93 44 read · 35 write · 14 destructive Creates and configures the S3 destination · Gets list of the s3 destination configuration values · Creates and updates a ruleset · Return a list of your deployed rulesets 2. ### Access 87 34 read · 37 write · 16 destructive List current users · List all roles and the permissions for each role · Get user information for the current context · Create a user 3. ### Knowledge 81 38 read · 30 write · 13 destructive Access all the XML definitions for existing dashboards · Create a new dashboard source XML definition · Access an existing dashboard XML definition · Update a specific dashboard XML definition 4. ### Cluster 78 41 read · 27 write · 10 destructive List cluster node configuration · List cluster node configuration · Add this bucket to the fix list · List cluster manager node bucket configuration 5. ### Search 52 31 read · 16 write · 5 destructive Access a fired alerts summary · Access saved search configurations · List unexpired triggered instances of this alert · Create a saved search 6. ### Introspection 46 39 read · 5 write · 2 destructive List the Splunk deployment volumes · Create a new index · List the recognized indexes on the server · List bucket attributes for all indexes 7. ### Deployment 30 19 read · 9 write · 2 destructive Get deployment client list with enabled status, server class, and host and port number of each · Get deployment client enabled status, server class for app distribution, and host and port number · Get deployment client disabled status · List distributed apps, including distributed state information 8. ### KV store 22 9 read · 10 write · 3 destructive Create a KV Store backup archive file · Create a collection · List all collections · Perform multiple queries in a batch **10 more areas · 140 actions** - Output **21** - License **20** - Federated search **17** - System **17** - Configuration **15** - Workload management **15** - Application **11** - SPL2 **11** - Metrics catalog **8** - Topology **5** Top actions ## The Splunk Platform API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 25 of Splunk Platform's 26 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `splunk_platform.users.list` List current users | List current users. | read | `identity.user.list` 474 connectors | | `splunk_platform.roles.list` List all roles and the permissions for each role | List all roles and the permissions for each role. | read | `identity.role.list` 184 connectors | | `splunk_platform.current_context.list` Get user information for the current context | Get user information for the current context. | read | `identity.current_user.get` 307 connectors | | `splunk_platform.users.create` Create a user | Create a user. | write | `identity.user.create` 262 connectors | | `splunk_platform.roles.create` Create a user role | Create a user role. | write | `identity.role.create` 105 connectors | | `splunk_platform.fired_alerts.list` Access a fired alerts summary | Access a fired alerts summary. | read | `monitoring.alert.list` 51 connectors | | `splunk_platform.users.delete` Remove the specified user from the system | Remove the specified user from the system. | destructive | `identity.user.delete` 253 connectors | | `splunk_platform.saved_searches.list` Access saved search configurations | Access saved search configurations. | read | `analytics.saved_query.list` 10 connectors | | `splunk_platform.tokens.list` List information on tokens | List information on tokens. | read | `identity.api_key.list` 96 connectors | | `splunk_platform.views.list` Access all the XML definitions for existing dashboards | Access all the XML definitions for existing dashboards. | read | `analytics.dashboard.list` 22 connectors | | `splunk_platform.views.create` Create a new dashboard source XML definition | Create a new dashboard source XML definition. | write | `analytics.dashboard.create` 18 connectors | | `splunk_platform.saved_searches.create` Create a saved search | Create a saved search. | write | `analytics.saved_query.create` 8 connectors | Try it ## Prompts to paste into Claude. Each one names the Splunk Platform actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which Splunk Platform alerts are open right now? Group them by service. calls `splunk_platform.fired_alerts.list` 2. Write write Create a user in Splunk Platform. Show me exactly what you will send before you save it. calls `splunk_platform.users.create` Governance for Splunk Platform ## Destructive actions wait for a yes. 83 Splunk Platform actions are destructive. The first 10: - Remove the specified user from the system `splunk_platform.users.delete` - Delete the specified role `splunk_platform.roles.delete` - Delete a specific dashboard `splunk_platform.views.delete` - Delete the named saved search `splunk_platform.saved_searches.delete` - Delete a token for the specified user `splunk_platform.tokens.delete` - Delete the specified message `splunk_platform.messages.delete` - Delete the {name} app `splunk_platform.apps_local.delete` - Delete the {search_id} search job `splunk_platform.search_jobs.delete` - Delete the tag and its associated field:value pair assignments `splunk_platform.search_tags.delete` - Removes the {name} index and the data contained in it `splunk_platform.data_indexes.delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do splunk_platform.users.delete confirm_policy: **human** Remove the specified user from the system? **intent:** the user asked me to remove the specified user from the system run suspended · waiting for a named person · key _splunk-platform-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "splunk-platform-agent", allowed_actions: ["splunk_platform.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "splunk_platform.users.delete", approver: "lead@example.com" }, { match: "splunk_platform.roles.delete", approver: "lead@example.com" }, { match: "splunk_platform.views.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Splunk Platform only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Splunk Platform costs on actionlake. Every Splunk Platform action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Splunk Platform refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 629 Splunk Platform actions - 629 actions page each page of a long list is one call - 314 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Splunk Platform action. 629 actions by area: the id your agent calls, what it does, and its effect. **Input 93** - `splunk_platform.data_ingest_rfsdestinations.create` Creates and configures the S3 destination write - `splunk_platform.data_ingest_rfsdestinations.list` Gets list of the s3 destination configuration values read - `splunk_platform.data_ingest_rulesets.create` Creates and updates a ruleset write - `splunk_platform.data_ingest_rulesets.list` Return a list of your deployed rulesets read - `splunk_platform.data_ingest_rfsdestinations.delete` Deletes the S3 destination destructive - `splunk_platform.data_ingest_rulesets.get` Return a named deployed ruleset read - and 87 more in this area **Access 87** - `splunk_platform.current_context.list` Get user information for the current context read - `splunk_platform.roles.list` List all roles and the permissions for each role read - `splunk_platform.users.create` Create a user write - `splunk_platform.users.list` List current users read - `splunk_platform.admin.replicate_saml_certs` Usage details After editing SAML IdP certificate files in $SPLUNK_HOME/etc/auth/idpCerts on one node in the cluster, yo… write - `splunk_platform.admin_duo_mfa.create` Create a Duo Multifactor configuration write - and 81 more in this area **Knowledge 81** - `splunk_platform.views.create` Create a new dashboard source XML definition write - `splunk_platform.views.get` Access an existing dashboard XML definition read - `splunk_platform.views.list` Access all the XML definitions for existing dashboards read - `splunk_platform.views.update` Update a specific dashboard XML definition write - `splunk_platform.admin_summarization.get` Get detailed information about the acceleration summaries of a specific datamodel read - `splunk_platform.admin_summarization.list` Get a list of field:value pairs that provide details about accelerated data models and their summaries read - and 75 more in this area **Cluster 78** - `splunk_platform.cluster_config.list` List cluster node configuration read - `splunk_platform.cluster_config_config.list` List cluster node configuration read - `splunk_platform.cluster_manager_buckets.fix` Add this bucket to the fix list write - `splunk_platform.cluster_manager_buckets.list` List cluster manager node bucket configuration read - `splunk_platform.cluster_config_config.update` Manage configuration details write - `splunk_platform.cluster_manager_buckets.fix_corrupt_bucket` Trigger a corruption fixup for this bucket destructive - and 72 more in this area **Search 52** - `splunk_platform.fired_alerts.get` List unexpired triggered instances of this alert read - `splunk_platform.fired_alerts.list` Access a fired alerts summary read - `splunk_platform.saved_searches.create` Create a saved search write - `splunk_platform.saved_searches.list` Access saved search configurations read - `splunk_platform.alerts_alert_actions.list` Access a list of alert actions read - `splunk_platform.alerts_metric_alerts.create` Create a streaming metric alert write - and 46 more in this area **Introspection 46** - `splunk_platform.data_index_volumes.list` List the Splunk deployment volumes read - `splunk_platform.data_indexes.create` Create a new index write - `splunk_platform.data_indexes.list` List the recognized indexes on the server read - `splunk_platform.data_indexes_extended.list` List bucket attributes for all indexes read - `splunk_platform.data_index_volumes.get` List {name} volume properties read - `splunk_platform.data_indexes.delete` Removes the {name} index and the data contained in it destructive - and 40 more in this area **Deployment 30** - `splunk_platform.deployment_client.list` Get deployment client list with enabled status, server class, and host and port number of each read - `splunk_platform.deployment_client_config.list` Get deployment client enabled status, server class for app distribution, and host and port number read - `splunk_platform.deployment_client_config_list_is_disabled.list` Get deployment client disabled status read - `splunk_platform.deployment_server_applications.list` List distributed apps, including distributed state information read - `splunk_platform.deployment_client.reload` Restart and reload {name} deployment client write - `splunk_platform.deployment_client_config.reload` Access client reload information write - and 24 more in this area **KV store 22** - `splunk_platform.kvstore_backup.create` Create a KV Store backup archive file write - `splunk_platform.kvstore_collections.create` Create a collection write - `splunk_platform.kvstore_collections.list` List all collections read - `splunk_platform.kvstore_data.batch_find_post` Perform multiple queries in a batch read - `splunk_platform.kvstore_backup.restore` Extracts the KV Store backup archive file and restores the KV Store write - `splunk_platform.kvstore_collections.delete` Delete a specific {collection} destructive - and 16 more in this area **Output 21** - `splunk_platform.data_outputs_tcp_default.create` Configure global tcpout properties write - `splunk_platform.data_outputs_tcp_default.list` Returns the current tcpout properties read - `splunk_platform.data_outputs_tcp_group.create` Configure a group of one or more data forwarding destinations write - `splunk_platform.data_outputs_tcp_group.list` Get configuration information about target groups read - `splunk_platform.data_outputs_tcp_default.delete` Disable the default forwarding settings destructive - `splunk_platform.data_outputs_tcp_default.get` Retrieve the named configuration read - and 15 more in this area **License 20** - `splunk_platform.licenser_groups.list` Lists all licenser groups read - `splunk_platform.licenser_licenses.create` Add a license entitlement to the current instance write - `splunk_platform.licenser_licenses.list` List all licenses added read - `splunk_platform.licenser_localpeer.list` Get license state information for the Splunk instance read - `splunk_platform.licenser_groups.get` List a specific licenser group read - `splunk_platform.licenser_groups.update` Activate a specific licenser group and deactivate the previously active one write - and 14 more in this area **Federated search 17** - `splunk_platform.data_federated_index.create` Creates a new federated index definition write - `splunk_platform.data_federated_index.list` Returns a list of federated indexes read - `splunk_platform.data_federated_provider.create` Creates a new federated provider definition write - `splunk_platform.data_federated_provider.list` Returns a list of federated providers read - `splunk_platform.data_federated_index.delete` Deletes a definition for a specific {federated_index_name} destructive - `splunk_platform.data_federated_index.disable` Turn off a specific federated index write - and 11 more in this area **System 17** - `splunk_platform.messages.create` Create a persistent message displayed at /services/messages write - `splunk_platform.messages.list` Show systemwide messages read - `splunk_platform.server_control.list` List actions that can be performed at this endpoint read - `splunk_platform.server_httpsettings.proxysettings` Create an HTTP Proxy server configuration stanza for use with splunkd write - `splunk_platform.messages.delete` Delete the specified message destructive - `splunk_platform.messages.get` Get details of the specified message read - and 11 more in this area **Configuration 15** - `splunk_platform.configs.create` Add stanza to {file} configuration file write - `splunk_platform.configs.list` List {file} configuration file stanzas read - `splunk_platform.properties.create_file` Create a configuration file write - `splunk_platform.properties.create_stanza` Add stanza to {file} configuration file or validate the entire configuration file write - `splunk_platform.configs_stanza.delete` Delete {stanza} in {file} configuration file destructive - `splunk_platform.configs_stanza.get` Get {stanza} in {file} configuration file read - and 9 more in this area **Workload management 15** - `splunk_platform.workloads_categories.list` List information about workload categories read - `splunk_platform.workloads_config_get_base_dirname.list` Get the name of the splunk parent cgroup read - `splunk_platform.workloads_config_preflight_checks.list` Run Linux preflight checks for workload management read - `splunk_platform.workloads_policy_search_admission_control.list` List the enabled status of admission rules read - `splunk_platform.workloads_categories.update` Edit workload categories write - `splunk_platform.workloads_config.disable` Disable workload management write - and 9 more in this area **Application 11** - `splunk_platform.apps.appinstall` Install or update an application from a local file or URL write - `splunk_platform.apps_apptemplates.list` List installed app templates read - `splunk_platform.apps_local.check_update` Get {name} app eai:acl information read - `splunk_platform.apps_local.create` Create an app write - `splunk_platform.apps_apptemplates.get` Get the {name} app template descriptor read - `splunk_platform.apps_local.delete` Delete the {name} app destructive - and 5 more in this area **SPL2 11** - `splunk_platform.spl2.convert` Converts an SPL search into an SPL2 read - `splunk_platform.spl2.convert_v2` Converts an SPL search into SPL2 and returns any warnings or errors that occurred as a result of the conversion read - `splunk_platform.spl2_datasets.list` List all datasets read - `splunk_platform.spl2_modules.dispatch` Start one or more new searches and return a search ID (SID) for each named search statement write - `splunk_platform.spl2_datasets.get` Get a dataset by ID or resource name read - `splunk_platform.spl2_module_permissions.get` Retrieve all of the permissions for a module read - and 5 more in this area **Metrics catalog 8** - `splunk_platform.catalog_metricstore_dimensions.list` Returns dimension names for a given metric read - `splunk_platform.catalog_metricstore_dimensions.values` Returns values of a {dimension-name} for a given metric read - `splunk_platform.catalog_metricstore_metrics.list` Returns metric names read - `splunk_platform.catalog_metricstore_rollup.create` Creates rollup policies for a specified metric index write - `splunk_platform.catalog_metricstore_rollup.delete` Deletes a rollup policy for a specific source {index} destructive - `splunk_platform.catalog_metricstore_rollup.get` Returns a list of the rollup summaries associated with a specific source {index} read - and 2 more in this area **Topology 5** - `splunk_platform.stack_explainer_v1_node_identity.get` Retrieves identity information for a remote Splunk platform node identified by its {guid} read - `splunk_platform.stack_explainer_v1_node_identity.list` Retrieves identity information for the local Splunk platform node read - `splunk_platform.stack_explainer_v1_topology.list` Retrieves a complete view of the deployment topology for the Splunk platform read - `splunk_platform.stack_explainer_v1_trusted_connections.list` Retrieves configuration settings for the trusted connections of the local node, including HEC, S2S, and search peer rel… read - `splunk_platform.stack_explainer_v1_trusted_connections.get` Retrieves configuration settings for the trusted connections of the remote node, identified by {guid} , including HEC,… read This index shows a sample of each area. All 629 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search. Questions ## The Splunk Platform MCP server, answered. **Is there a Splunk Platform MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 629 Splunk Platform actions across input, access, knowledge and cluster, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Splunk Platform. **What do I need to connect Splunk Platform?** Splunk authentication token (Settings > Tokens, or authorization/tokens). Plus your host. The free call account { op: "connections.requirements", service: "splunk_platform" } lists exactly what to paste. **Can an AI agent delete or change things in Splunk Platform?** Only if its key allows it, and only with an explicit confirmation. 83 Splunk Platform actions are destructive, including remove the specified user from the system, delete the specified role and delete a specific dashboard. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Splunk Platform API limit?** actionlake paces every call to the limits in the Splunk Platform service file: 300 calls a minute per connection. Repeated reads are answered from cache (314 Splunk Platform actions can be), which never reaches Splunk Platform. **What does a Splunk Platform action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (629 Splunk Platform actions page). Cache hits, searches, dry runs and calls Splunk Platform refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Splunk Platform API does it cover?** The Splunk Enterprise REST API reference 10.6 (also Splunk Cloud Platform), plus the SPL2 orchestrator API at your Splunk Platform instance's API base URL, which you enter when connecting. It is built from Splunk Platform's documentation as read on 22 October 2026. 629 actions in 18 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Splunk Platform data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Splunk Platform credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Splunk Platform Shares the most action names with - [Pulumi Cloud 11](https://actionlake.com/connectors/pulumi-cloud) - [ClickHouse Cloud 11](https://actionlake.com/connectors/clickhouse-cloud) - [Sumo Logic 11](https://actionlake.com/connectors/sumo-logic) - [Harbor 11](https://actionlake.com/connectors/harbor) - [Spacelift 9](https://actionlake.com/connectors/spacelift) - [env zero (env0) 8](https://actionlake.com/connectors/env-zero-env0) Joins with, on shared entities - [Docebo 4](https://actionlake.com/connectors/docebo) - [Rubrik Security Cloud 3](https://actionlake.com/connectors/rubrik-security-cloud) - [Commvault Cloud 3](https://actionlake.com/connectors/commvault-cloud) - [Cloudflare 3](https://actionlake.com/connectors/cloudflare) - [Delinea Secret Server 3](https://actionlake.com/connectors/delinea-secret-server) - [authentik 3](https://actionlake.com/connectors/authentik) Browse - [All Developer & infrastructure connectors](https://actionlake.com/connectors/category/developer-and-infrastructure) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Splunk Platform; the name is the vendor's own. Counts are from the Splunk Platform service file, version 1.0.0. ## Give your agent Splunk Platform today. [Connect Splunk Platform free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/splunk-platform More: https://actionlake.com/llms.txt