Configure the Splunk MCP Server

Overview

Splunk’s official MCP server ships as the Splunk MCP Server app for Splunk Cloud, and gives AI agents structured access to your Splunk data. Access is authorized through OAuth 2.0, using a Splunk OAuth client you register yourself.

1. Install the Splunk MCP Server app

1. Log in to Splunk Cloud as an administrator and open the Apps menu.
2. Look for Splunk MCP Server. If it’s there, move on to the next section.
3. If it isn’t, check your Splunk Cloud version — on older deployments you install it yourself. Get the official Splunk MCP Server app from Splunkbase and install it on your search head or search head cluster using your organization’s Splunk Cloud app-installation process. Splunk may require a restart.

2. Enable token authentication

1. Go to Settings → Tokens.
2. If the page says token authentication is disabled, select Enable Token Authentication.
3. Confirm the Tokens page becomes available.

Your role needs the edit_tokens_settings capability to change this setting.

3. Grant MCP permissions

Go to Settings → Access controls → Roles and edit the roles held by the people who will reach Splunk through Dtwo. Grant the mcp_tool_execute capability to the users who will call the MCP tools.

4. Enable tools and copy the endpoint URL

1. Go to Apps → Splunk MCP Server.
2. Open the MCP Server settings or tool management section and review the available tools. Splunk’s built-in platform tools are enabled by default — administrators can disable individual ones, and custom tools have to be enabled explicitly.
3. Enable the tools you want to expose to Dtwo.
4. Copy the MCP endpoint URL. You’ll need it in step 6.

5. Create the Dtwo OAuth client in Splunk

1. In Splunk, go to Settings → Authentication methods → Splunk OAuth Clients → Create Client.
2. Give the client a name, for example Dtwo.
3. For Redirect URI, enter your Dtwo gateway’s OAuth callback URL — found in the Overview tab for your gateway in the Dtwo UI.
4. Set the scopes to openid and offline_access.
5. Save the client and copy the credentials immediately. Splunk shows you the Client ID, Client Secret, Authorization URL, and Token URL. The client secret is shown only once, so save it before you leave the page.

6. Add the MCP server to your gateway config

Go to your gateway in the Dtwo UI and open Configuration → Advanced. In the mcp_servers section add the following entry:

  - name: splunk
    description: "Splunk official MCP server."
    url: "https://<SPLUNK_MCP_ENDPOINT>"
    transport_type: streamablehttp
    authentication:
      type: oauth
      grant_type: authorization_code
      scopes:
        - openid
        - offline_access
      client_id: "<SPLUNK_CLIENT_ID>"
      client_secret: "<SPLUNK_CLIENT_SECRET>"
      authorization_url: "<SPLUNK_AUTHORIZATION_URL>"
      token_url: "<SPLUNK_TOKEN_URL>"
      redirect_uri: "<CALLBACK_URL>"
      pkce_enabled: true

Replace the placeholder values:

• <SPLUNK_MCP_ENDPOINT> — the MCP endpoint URL you copied from the Splunk MCP Server app in step 4.
• <SPLUNK_CLIENT_ID> and <SPLUNK_CLIENT_SECRET> — from the OAuth client you created in step 5.
• <SPLUNK_AUTHORIZATION_URL> and <SPLUNK_TOKEN_URL> — shown alongside the credentials when you saved the client.
• <CALLBACK_URL> — your Dtwo gateway’s OAuth callback URL, found in the Overview tab for your gateway in the Dtwo UI. Use the same value you entered as the redirect URI in Splunk.

7. Deploy and verify

Save the configuration and deploy the gateway.

Then, in your AI client, ask it to authorize Splunk via the gateway. This opens the Splunk sign-in and consent screen — sign in as the user whose role the agent should inherit, and approve the consent prompt. Once authorized, confirm the splunk-* tools appear and run a read-only call, such as a simple search, to make sure the connection and permissions work.

If the tools don’t appear after you authorize, refresh the tool list in your AI client — some clients don’t pick it up automatically.