Integration

Splunk integration

Log analytics platform for searching, monitoring, and analyzing machine-generated data. Execute SPL queries, manage indexes, and create alerts. Essential for log management, SIEM, and observability.

Connect Splunk How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Splunk.Built from the 17 Splunk tools below, on the connection you add once.

Common Splunk use cases

data export
job cleanup
alert setup
resource management
configuration review
log analysis
data ingestion
index creation
job monitoring
log inspection

What you can do with Splunk

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Saved search, 4 operations

create_saved_searchCreate saved searchPOSTCreates a new saved search or report in Splunk.
dispatch_saved_searchDispatch saved searchPOSTRuns a saved search in Splunk.
get_saved_searchGet saved searchGETRetrieves a specific saved search from Splunk.
list_saved_searchesList saved searchesGETLists all saved searches in Splunk.

Search job, 4 operations

control_search_jobControl search jobPOSTControls a Splunk search job (cancel, pause, finalize, etc.).
create_search_jobCreate search jobPOSTCreates a new search job in Splunk.
delete_search_jobDelete search jobDELETEDeletes a Splunk search job and its cached results.
get_search_jobGet search jobGETGets the status of a Splunk search job.

Index, 3 operations

create_indexCreate indexPOSTCreates a new index in Splunk.
get_indexGet indexGETRetrieves details for a specific Splunk index.
list_indexesList indexesGETLists all indexes in Splunk.

Event, 2 operations

get_search_eventsGet search eventsGETRetrieves raw events from a Splunk search job.
submit_eventSubmit eventPOSTSubmits an event to Splunk via HEC.

Alert, 1 operation

list_fired_alertsList fired alertsGETLists triggered alerts in Splunk.

Export, 1 operation

export_search_resultsExport search resultsPOSTExecutes a search and streams results directly.

Search result, 1 operation

get_search_resultsGet search resultsGETRetrieves results from a Splunk search job.

Server, 1 operation

get_server_infoGet server infoGETRetrieves Splunk server information.

Use Splunk from Claude Code, Cursor or Codex

Connect Splunk in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Splunk operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Splunk

Create your workspace
Sign up free. Nothing to install.
Connect Splunk once
Add your Splunk connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Splunk integration FAQ

What can you do with the Splunk integration?

LiveContext exposes 17 operations on Splunk, covering saved search, search job, index and event. Common uses include data export, job cleanup and alert setup.