Skip to main content

​
Overview

The Splunk AI connector gives Rootly AI current logs and operational context during an investigation. Rootly AI can run bounded Splunk Search Processing Language (SPL) searches, discover indexes and sourcetypes, inspect knowledge objects, and review alert definitions, firing history, and throttling state. The connection uses the official MCP Server for Splunk Platform and an encrypted MCP token. Rootly connects to the server over HTTPS with the streamable HTTP transport. The connector supports Splunk Enterprise and Splunk Cloud Platform deployments that can expose an MCP endpoint to Rootly.
This AI connector is separate from the Splunk alert source. The alert source sends Splunk alerts into Rootly. The AI connector lets Rootly AI query Splunk during an investigation. You can configure both for the same Rootly team.

​
Before You Start

You’ll need:
  • MCP Server for Splunk Platform version 2.0.0 installed on the search head or search head cluster that Rootly should query.
  • Token authentication and API access enabled for the Splunk deployment.
  • A dedicated Splunk user with mcp_tool_execute, permission to use the MCP APIs, and search access limited to the indexes Rootly AI should investigate.
  • A Splunk administrator with mcp_tool_admin and permission to create a token for the dedicated user.
  • A public HTTPS MCP endpoint that Rootly can reach with a certificate signed by a trusted certificate authority.
  • Permission in Rootly to manage AI connectors.
Splunkbase lists version 2.0.0 as compatible with Splunk Enterprise and Splunk Cloud Platform versions 9.3 through 10.5. Check the Splunkbase listing before upgrading either product.
The Splunk user is the primary data-access boundary. Create a dedicated user and grant it access only to the indexes, search commands, knowledge objects, and alerts needed for incident investigation.

​
Configure Splunk

1

Install the MCP Server App

Download MCP Server for Splunk Platform from Splunkbase and install it on your Splunk search head or search head cluster. Restart Splunk if the installation prompts you to do so.For the current app workflow, follow Splunk’s 2.0 instructions for connecting to the MCP Server and configuring its settings.
2

Create a Dedicated Role and User

Grant mcp_tool_execute to the role used by the connector. Give that role permission to access the MCP APIs and search only the indexes Rootly AI needs.Keep administrative capabilities, user management, and unrelated indexes out of the role. Splunk continues to apply the user’s role-based access control to every search and tool call.
3

Review MCP Tools and Guardrails

In the Splunk MCP Server app, keep the core platform tools needed for searches, metadata, knowledge objects, and alert investigation enabled. Keep Splunk’s timeout, row-limit, rate-limit, and allowed-command guardrails configured for your environment.Rootly requires the splunk_run_query tool and the makeresults SPL command to verify the connection. Add makeresults to the MCP Server’s allowed search commands if you restrict commands. Disabling the tool or command prevents setup from completing.
4

Generate an Encrypted Token

In the Splunk MCP Server app, generate an encrypted token for the dedicated connector user. The administrator creating it needs mcp_tool_admin plus edit_tokens_all. A user creating a token for themselves needs mcp_tool_admin plus edit_tokens_own.Choose an expiration that matches your credential-rotation policy and copy the token when Splunk displays it. Splunk shows the token value only once.
5

Copy the MCP Endpoint

Copy the endpoint shown in the Splunk MCP Server app. Rootly accepts these HTTPS endpoint forms:
Splunk management endpoint
Splunk Web proxy endpoint
Splunk Cloud Services endpoint
The Splunk Web proxy locale can differ from en-US. Use the exact endpoint displayed by the MCP Server app. The endpoint must not contain credentials, query parameters, or a fragment.
Rootly verifies TLS certificates. Use a certificate signed by a trusted certificate authority. Self-signed certificates and private network endpoints can’t be used for a production Rootly connection.

​
Connect Splunk

1

Open the Splunk Card

In Rootly, go to AI & Agents → Connectors, find Splunk, and click Connect.
2

Enter the Endpoint

Paste the full HTTPS MCP endpoint copied from the Splunk MCP Server app.
3

Enter the Encrypted Token

Paste the encrypted MCP token generated for the dedicated connector user, then click Connect.
4

Confirm the Connection

Rootly verifies that Splunk advertises splunk_run_query, then runs a synthetic search that creates one in-memory result. The connector becomes active only after both checks succeed.
If a Splunk connection already exists, Rootly keeps it active while checking the replacement endpoint and token. Rootly replaces the working connection only after the new connection passes both checks.

​
What Rootly AI Can Investigate

Rootly exposes a reviewed set of Splunk platform tools for investigation: Rootly checks the tool name before every call. Tools for user listings, token administration, running saved searches, Splunk AI Assistant for SPL, custom MCP tools, and Splunk Observability Cloud aren’t exposed by this connector. A tool added by Splunk doesn’t become available until Rootly reviews and allows it. Rootly doesn’t independently authorize the SPL submitted through splunk_run_query. Splunk’s MCP server enforces its configured tools, role-based access, allowed SPL commands, row limits, timeouts, workload controls, and rate limits. Configure the dedicated user’s permissions and Splunk’s allowed-command list as the authoritative boundary for searches, including commands that can write data. A tool name must pass Rootly’s reviewed list, and every operation must pass the Splunk deployment’s controls.

​
Investigation Examples

Include an index or sourcetype, service, environment, and bounded UTC time range when possible:
  • “Which new error signatures appeared in index=production during the 20 minutes after the deploy?”
  • “Compare checkout API errors in the incident window with the preceding 30 minutes, grouped by status code and host.”
  • “Find events for this request ID and summarize the sequence across services.”
  • “Which Splunk alerts fired for payment services during the incident, and were any throttled?”
  • “List the indexes and sourcetypes relevant to Kubernetes ingress logs before searching for 5xx responses.”
  • “Which dashboard or saved-search definition is most relevant to this service failure?”
Start with discovery when you don’t know the exact index or sourcetype. Narrow searches before returning raw events so results remain within the deployment’s MCP limits.

​
Access and Data Handling

  • Splunk permissions apply. Rootly AI can read only the data available to the user represented by the encrypted token.
  • Reviewed investigation tools. Rootly limits calls to its pinned Splunk tool set and doesn’t expose administrative or user-discovery tools.
  • On-demand queries. Rootly queries Splunk when an investigation or direct question needs current evidence.
  • Encrypted credential storage. Rootly encrypts the MCP token at rest. Disconnecting the AI connector removes the stored credential.
  • Redacted session history. Raw Splunk tool results are available to the active investigation but aren’t persisted in the AI session transcript.
  • Quality traces. Connector results can appear in retained large language model (LLM) traces used for quality monitoring. See Data Privacy for Rootly AI for the retention boundary.
  • Splunk limits apply. Searches count against the deployment’s compute, workload, timeout, row-limit, and rate-limit controls.
Treat the encrypted MCP token as a credential. It is restricted to MCP authentication and can’t be used as a regular Splunk API token, but anyone holding it can use the permissions of its Splunk user through the MCP server until the token expires or is revoked.

​
Manage the Connection

Open AI & Agents → Connectors and find the Splunk card to reconnect or disconnect it. Reconnect after the encrypted token expires, is revoked, or is invalidated by an MCP Server key rotation. Generate a replacement encrypted token in the Splunk MCP Server app, then submit the endpoint and new token through the Splunk card. A failed reconnect leaves the previous connection unchanged. Disconnecting removes Rootly’s stored endpoint and token and prevents future queries. It doesn’t revoke the token in Splunk. Revoke the token separately in the Splunk MCP Server app when the connection is no longer needed.

​
Troubleshooting

Confirm the endpoint is public, uses HTTPS, and ends in /services/mcp, a localized Splunk Web proxy path such as /en-US/splunkd/__raw/services/mcp, or the supported Splunk Cloud Services path. Check firewall rules and allow Rootly’s published IP ranges when your deployment restricts inbound traffic.
Install the complete certificate chain for the public MCP endpoint and confirm its hostname matches the certificate. Rootly doesn’t disable certificate verification for self-signed production endpoints.
Confirm you pasted the encrypted token generated by the MCP Server app. Regular Splunk API tokens and HTTP Event Collector tokens don’t work with this connector. Generate a replacement if the token expired, was revoked, or was invalidated by an MCP Server key rotation.
Open the MCP Server app and enable the core splunk_run_query tool. Confirm the connector user’s role includes mcp_tool_execute and access to the MCP APIs, then reconnect.
Check the connector user’s role, index restrictions, search filters, and time range in Splunk. Rootly AI can’t search an index or use a command that Splunk blocks for that user.
Narrow the time range, filter by index and sourcetype, aggregate before returning raw events, or adjust the MCP Server guardrails if your Splunk administrator approves. Splunk’s timeout, row-limit, workload, and rate-limit settings remain authoritative.
Upgrade MCP Server for Splunk Platform to version 2.0.0, where Splunk added alert-discovery and alert-throttling tools. Confirm those tools are enabled in the MCP Server app and permitted for the connector user’s role.

​
Frequently Asked Questions

Rootly blocks MCP tool names it hasn’t reviewed, including user administration, token management, custom tools, and other management operations. Rootly doesn’t independently validate the SPL sent through splunk_run_query. Splunk’s allowed-command list and the dedicated user’s permissions determine whether a search can write data, so exclude write-capable commands and keep that user restricted.
No. The connector requires an encrypted token generated in the Splunk MCP Server app. Splunk restricts that token to MCP authentication.
No. This connector targets Splunk Enterprise and Splunk Cloud Platform through the official MCP Server app or supported Splunk Cloud Services endpoint. It doesn’t configure the separate Splunk Observability Cloud MCP gateway.
Limit the dedicated Splunk user’s role. Restrict its indexes, search commands, knowledge objects, and alert access to the operational data needed for incident investigation, then test the same user in Splunk before connecting it to Rootly.

Connectors Overview

See every AI connector and how Rootly AI combines their evidence.

Splunk Alert Source

Send Splunk alerts into Rootly for routing, paging, and incident workflows.

Data Privacy for Rootly AI

Review Rootly AI’s data access, retention, and training controls.