What if a search takes longer than the HTTP timeout?

Fall back to exec_mode=normal: create the job, poll GET /services/search/jobs/{sid} until dispatchState is DONE, then fetch results separately.

Should the tool allow arbitrary SPL?

Reject searches that omit an index= filter and cap earliest_time to a reasonable maximum lookback, the same way an unscoped SQL query would be rejected by a database tool.

How is authentication set up?

Generate a token via Splunk's token-based auth (Settings > Tokens) rather than passing a username/password on every request.

monitoringHowTo

Run Splunk Searches from an MCP Server

Execute SPL searches against Splunk's REST API as an MCP tool, handling the asynchronous create-poll-retrieve job lifecycle.

Quick Answer / TL;DR

Splunk searches run as asynchronous jobs through the REST API: create the job, poll its status until it reports done, then fetch results - a single blocking HTTP call is not enough on its own.

Key Takeaways

Splunk search jobs are asynchronous by default; exec_mode=blocking simplifies this to one call but still has its own timeout to manage.
SPL pipes commands together with |, starting from an index filter and narrowing down - always scope to a specific index rather than searching all indexes.
Always pass an explicit earliest_time - an unscoped search over all time on a large index is expensive and slow.

Creating and reading a search job

With exec_mode set to blocking, the create call itself waits for the search to finish (up to its own timeout), which avoids a manual poll loop for most queries short enough to run inline.

typescript

async function splunkSearch(query: string, earliestTime = "-1h", maxResults = 100) {
  const base = process.env.SPLUNK_URL!; // e.g. https://splunk.example.com:8089
  const auth = { Authorization: `Bearer ${process.env.SPLUNK_TOKEN}` };

  const createRes = await fetch(`${base}/services/search/jobs?output_mode=json`, {
    method: "POST",
    headers: { ...auth, "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      search: `search ${query}`,
      earliest_time: earliestTime,
      latest_time: "now",
      max_count: String(maxResults),
      exec_mode: "blocking",
    }),
  });
  const { sid } = await createRes.json();

  const resultsRes = await fetch(
    `${base}/services/search/jobs/${sid}/results?output_mode=json`,
    { headers: auth },
  );
  const { results } = await resultsRes.json();
  return results;
}

// Example: SPL scoped to one index with a time bound
await splunkSearch('index=web status=5* | stats count by uri_path', "-1h");