MCP (Model Context Protocol) has been making waves as it provides a standard way of connecting AI applications to external systems. I caught up with Hal Rottenberg at Splunk .conf25 to discover more about the Splunk MCP Server release (for both Splunk Cloud and on-premises). To quote Hal, it is like ‘…watching the Science Fiction of our youth come into being…’. Hal walks us through what is possible and gives an example of seamlessly connecting Atlassian Confluence with Splunk from an MCP Cli

Transcript

Auto-generated captions, lightly cleaned. Speakers are not separately labeled.

Hey everyone, we’re out here at docom 25 and I ran into Hal here and MCP server brand new in Splunk and you know a lot about it. What can you tell us? >> So um MCP server if you’ve not heard of it model context protocol um it is one of the new hotnesses I guess you could say in the AI realm because it’s all hot but it is important. It’s pretty cool. Um, when you think about like um, uh, so buzzwords and working backwards from buzzwords to what’s real, uh, what’s real. Um, MCP is just this is protocol. Um, but the buzzword is agent or agentic and the buzzword is like, you know, is this system doing something itself or is it, you know, I type something and it spits text out. So MCP is kind of part of the agentic wave. It’s it’s enabling the the bigger things. So, it’s where the systems can start to talk to each other. Um, bringing more information kind of into scope. So, and for me, it’s been kind of exciting to kind of watch >> basically the the capability get, you know, a little more a little more. So, it it feels a little bit like we’re seeing the science fiction of our youth kind of start to become into being. So, it’s pretty exciting time. But what Splunk is doing is we have a Splunk MCP server. Uh this shipped uh we had a controlled availability release a couple months ago, but now we’re are announcing that it’s general availability for Splunk cloud customers and uh beta for Splunk enterprise customers. So that’s pretty much everybody. Every Splunk customer has a capability to check this out. Um basically what you need, you need a few pieces. You need a client and uh some of you may be familiar with for example Claude Desktop. Um there there’s a lot of different pieces of software and services that can be that MCP client, but what it’s doing it’s it’s um making a tool available to the LLM. >> So why does an LLM need a tool? Well, uh what an LLM, a large language model is great at doing is generating text. What it’s not great at doing is going outside of the box that it’s in. So MCP is a it’s a protocol, a way to give a structured set of tools to the LLM. And for example, with Splunk, you run a search. Well, I can type in a question and say, I’ve I I need to figure out what’s going on with with app XYZ and you can you can have Splunk go run the search on your behalf. You’ll give it give it a set of um um uh privileges. You have to go make an API key. Um so it’ll run as the the user the of the API key. And once you’ve configured that, it will basically um it’s it’s very nimble. So you describe a problem and it will go get metadata from Splunk about your environment. For example, list indexes and read the source types and that kind of thing and then try to solve your problem. Now, one tool isn’t so interesting. Um, one of my favorite examples, and we wrote this up in in Splunk Lantern, um, is there’s a getting started guide that that helps you kind of get started with the Splunk MCP server, but one of the use cases is uh, it really hit home for me. Um, we grabbed um, uh, Atlassian. So, they have the Confluence uh, wiki. There’s a um, a Confluence MCP server. So what you do is let’s say that you’ve got and you could do this with anything any set of information you know it could be um a different kind of wiki it could be um a GitHub repo it could be a notes application like obsidian there’s a lot of different ways to do this or notion have a runbook you know hey this is what my application is in Splunk um you know here’s the application name here’s a set of searches that we commonly whatever just knowledge that you know you would already create for your team be able to do what you do, right? Engineering runbooks, that kind of thing. Tell the model or give the give it access to multiple tools like Confluence and Splunk and then say I I’m an engineer. I’ve got an error message in this app. >> You don’t tell it what the SPL is. You don’t tell the name of the indexes. It will go to Confluence, search the for the right page with the, you know, for example, app name runbook. It’ll come up with that search itself. It’ll read the information from Confluence and if that that page says, you know, here are the name of our indexes, here’s some SQL, what whatever or here’s, you know, linked our dashboard, it’ll then go ask Splunk about that artifact. It’ll go look up the knowledge objects. It’ll pull that into scope and then it’ll go write a search and it’ll basically iterate multiple times until, you know, let’s say that you’ve got, you know, error code such and such. It’ll say, “Yeah, we found error code such it.” So, it’ll refine it. You can watch it as it thinks. It’s really fascinating to watch. Any end of the day, the MCP server is kind of the start of that journey to enable this kind of multi-turn interaction with an Gentic AI system. >> So you have all these systems like Atlassian, you mentioned Notion, you mentioned Obsidian, and now Splunk does. You have your MCP server, all of these different tools. Yep. You have your MCP client, and it just automatically works with all these MCP servers and the runbook scenario that you said. Is that accurate? >> Yeah, that’s that’s pretty accurate. Yeah. And it’s um it’s it’s kind of interesting to see the models are all different. The capabilities are different. You know, you might have, you know, OpenAI or Gemini or, you know, a handful of uh you know, Claude desktop, Claude models. Um there’s a lot of different ones. They they all have some subtleties that you’ll you’ll kind of get used to um as you kind of work with them. And some of them are better at working with MCP tools than others. It is still a pretty new technology, but once you get the right ones like a like a Cloud 4 or a GPD5 or Gemini 2.5 Pro, >> it’s off to the races. >> Now, for the audience out there that wants to get started with Splunk MCP server and some MCP clients kind of get going, get their feet wet. How do they go get this information? >> Yeah. Now, one of the funny parts is that this it’s a new technology. You’re everybody’s trying it. It’s hot. There’s high demand, right? Well, there’s a lot of open- source uh implementations of even a Splunk MCP server. I counted seven the last time I looked. Uh it’s a funny circumstance, but there’s only the one official one, right? Um if you s search for Splunk MCP server, um we have an entry in Splunk Base. So, there’s an app that you install uh and that will run on your Splunk Enterprise instance or there’s a separate service that runs in Splunk Cloud. Um, but that that had that splint based listing has links to all the documentation and uh also there’s a there’s a lantern article that I mentioned that kind of extends out some of those use cases for you. >> Fantastic. Thanks for all the information. Appreciate it. All right. Thanks. [Music]