> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rootly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk AI Connector

> Connect Rootly AI to Splunk through the official MCP Server app for investigation searches, index discovery, knowledge objects, and alerts.

## Overview

The Splunk AI connector gives Rootly AI current logs and operational context during an investigation. Rootly AI can run bounded Splunk Search Processing Language (SPL) searches, discover indexes and sourcetypes, inspect knowledge objects, and review alert definitions, firing history, and throttling state.

The connection uses the official [MCP Server for Splunk Platform](https://splunkbase.splunk.com/app/7931) and an encrypted MCP token. Rootly connects to the server over HTTPS with the streamable HTTP transport. The connector supports Splunk Enterprise and Splunk Cloud Platform deployments that can expose an MCP endpoint to Rootly.

<Note>
  This AI connector is separate from the [Splunk alert source](/integrations/splunk). The alert source sends Splunk alerts into Rootly. The AI connector lets Rootly AI query Splunk during an investigation. You can configure both for the same Rootly team.
</Note>

***

## Before You Start

You'll need:

* **MCP Server for Splunk Platform version 2.0.0** installed on the search head or search head cluster that Rootly should query.
* **Token authentication and API access** enabled for the Splunk deployment.
* **A dedicated Splunk user** with `mcp_tool_execute`, permission to use the MCP APIs, and search access limited to the indexes Rootly AI should investigate.
* **A Splunk administrator** with `mcp_tool_admin` and permission to create a token for the dedicated user.
* **A public HTTPS MCP endpoint** that Rootly can reach with a certificate signed by a trusted certificate authority.
* **Permission in Rootly to manage AI connectors.**

Splunkbase lists version 2.0.0 as compatible with Splunk Enterprise and Splunk Cloud Platform versions 9.3 through 10.5. Check the [Splunkbase listing](https://splunkbase.splunk.com/app/7931) before upgrading either product.

<Warning>
  The Splunk user is the primary data-access boundary. Create a dedicated user and grant it access only to the indexes, search commands, knowledge objects, and alerts needed for incident investigation.
</Warning>

***

## Configure Splunk

<Steps>
  <Step title="Install the MCP Server App">
    Download **MCP Server for Splunk Platform** from [Splunkbase](https://splunkbase.splunk.com/app/7931) and install it on your Splunk search head or search head cluster. Restart Splunk if the installation prompts you to do so.

    For the current app workflow, follow Splunk's 2.0 instructions for [connecting to the MCP Server and configuring its settings](https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/2.0/connecting-to-the-mcp-server-and-settings).
  </Step>

  <Step title="Create a Dedicated Role and User">
    Grant `mcp_tool_execute` to the role used by the connector. Give that role permission to access the MCP APIs and search only the indexes Rootly AI needs.

    Keep administrative capabilities, user management, and unrelated indexes out of the role. Splunk continues to apply the user's role-based access control to every search and tool call.
  </Step>

  <Step title="Review MCP Tools and Guardrails">
    In the Splunk MCP Server app, keep the core platform tools needed for searches, metadata, knowledge objects, and alert investigation enabled. Keep Splunk's timeout, row-limit, rate-limit, and allowed-command guardrails configured for your environment.

    Rootly requires the `splunk_run_query` tool and the `makeresults` SPL command to verify the connection. Add `makeresults` to the MCP Server's allowed search commands if you restrict commands. Disabling the tool or command prevents setup from completing.
  </Step>

  <Step title="Generate an Encrypted Token">
    In the Splunk MCP Server app, generate an encrypted token for the dedicated connector user. The administrator creating it needs `mcp_tool_admin` plus `edit_tokens_all`. A user creating a token for themselves needs `mcp_tool_admin` plus `edit_tokens_own`.

    Choose an expiration that matches your credential-rotation policy and copy the token when Splunk displays it. Splunk shows the token value only once.
  </Step>

  <Step title="Copy the MCP Endpoint">
    Copy the endpoint shown in the Splunk MCP Server app. Rootly accepts these HTTPS endpoint forms:

    ```text Splunk management endpoint theme={null}
    https://splunk.example.com:8089/services/mcp
    ```

    ```text Splunk Web proxy endpoint theme={null}
    https://splunk.example.com/en-US/splunkd/__raw/services/mcp
    ```

    ```text Splunk Cloud Services endpoint theme={null}
    https://deployment.api.scs.splunk.com/deployment/mcp/v1/
    ```

    The Splunk Web proxy locale can differ from `en-US`. Use the exact endpoint displayed by the MCP Server app. The endpoint must not contain credentials, query parameters, or a fragment.
  </Step>
</Steps>

<Warning>
  Rootly verifies TLS certificates. Use a certificate signed by a trusted certificate authority. Self-signed certificates and private network endpoints can't be used for a production Rootly connection.
</Warning>

***

## Connect Splunk

<Steps>
  <Step title="Open the Splunk Card">
    In Rootly, go to **AI & Agents → Connectors**, find **Splunk**, and click **Connect**.
  </Step>

  <Step title="Enter the Endpoint">
    Paste the full HTTPS MCP endpoint copied from the Splunk MCP Server app.
  </Step>

  <Step title="Enter the Encrypted Token">
    Paste the encrypted MCP token generated for the dedicated connector user, then click **Connect**.
  </Step>

  <Step title="Confirm the Connection">
    Rootly verifies that Splunk advertises `splunk_run_query`, then runs a synthetic search that creates one in-memory result. The connector becomes active only after both checks succeed.
  </Step>
</Steps>

If a Splunk connection already exists, Rootly keeps it active while checking the replacement endpoint and token. Rootly replaces the working connection only after the new connection passes both checks.

***

## What Rootly AI Can Investigate

Rootly exposes a reviewed set of Splunk platform tools for investigation:

| Surface                     | What Rootly AI can inspect                                                                         |
| --------------------------- | -------------------------------------------------------------------------------------------------- |
| **Searches**                | Logs, events, aggregations, and other results returned by bounded SPL searches                     |
| **Indexes and sourcetypes** | Available indexes, index details, metadata, and sourcetypes visible to the connector user          |
| **Knowledge objects**       | Searchable knowledge objects, including dashboards and saved-search definitions returned by Splunk |
| **Alerts**                  | Alert definitions, individual alert details, fired-alert history, and fired-alert details          |
| **Alert throttling**        | Throttle settings and active throttles for Splunk alerts                                           |
| **Instance information**    | Splunk version, system details, and operational status returned by the MCP server                  |

Rootly checks the tool name before every call. Tools for user listings, token administration, running saved searches, Splunk AI Assistant for SPL, custom MCP tools, and Splunk Observability Cloud aren't exposed by this connector. A tool added by Splunk doesn't become available until Rootly reviews and allows it. Rootly doesn't independently authorize the SPL submitted through `splunk_run_query`.

Splunk's MCP server enforces its configured tools, role-based access, allowed SPL commands, row limits, timeouts, workload controls, and rate limits. Configure the dedicated user's permissions and Splunk's allowed-command list as the authoritative boundary for searches, including commands that can write data. A tool name must pass Rootly's reviewed list, and every operation must pass the Splunk deployment's controls.

## Investigation Examples

Include an index or sourcetype, service, environment, and bounded UTC time range when possible:

* *"Which new error signatures appeared in `index=production` during the 20 minutes after the deploy?"*
* *"Compare checkout API errors in the incident window with the preceding 30 minutes, grouped by status code and host."*
* *"Find events for this request ID and summarize the sequence across services."*
* *"Which Splunk alerts fired for payment services during the incident, and were any throttled?"*
* *"List the indexes and sourcetypes relevant to Kubernetes ingress logs before searching for 5xx responses."*
* *"Which dashboard or saved-search definition is most relevant to this service failure?"*

Start with discovery when you don't know the exact index or sourcetype. Narrow searches before returning raw events so results remain within the deployment's MCP limits.

***

## Access and Data Handling

* **Splunk permissions apply.** Rootly AI can read only the data available to the user represented by the encrypted token.
* **Reviewed investigation tools.** Rootly limits calls to its pinned Splunk tool set and doesn't expose administrative or user-discovery tools.
* **On-demand queries.** Rootly queries Splunk when an investigation or direct question needs current evidence.
* **Encrypted credential storage.** Rootly encrypts the MCP token at rest. Disconnecting the AI connector removes the stored credential.
* **Redacted session history.** Raw Splunk tool results are available to the active investigation but aren't persisted in the AI session transcript.
* **Quality traces.** Connector results can appear in retained large language model (LLM) traces used for quality monitoring. See [Data Privacy for Rootly AI](/ai/data-privacy-for-rootly-ai) for the retention boundary.
* **Splunk limits apply.** Searches count against the deployment's compute, workload, timeout, row-limit, and rate-limit controls.

Treat the encrypted MCP token as a credential. It is restricted to MCP authentication and can't be used as a regular Splunk API token, but anyone holding it can use the permissions of its Splunk user through the MCP server until the token expires or is revoked.

***

## Manage the Connection

Open **AI & Agents → Connectors** and find the Splunk card to reconnect or disconnect it.

Reconnect after the encrypted token expires, is revoked, or is invalidated by an MCP Server key rotation. Generate a replacement encrypted token in the Splunk MCP Server app, then submit the endpoint and new token through the Splunk card. A failed reconnect leaves the previous connection unchanged.

Disconnecting removes Rootly's stored endpoint and token and prevents future queries. It doesn't revoke the token in Splunk. Revoke the token separately in the Splunk MCP Server app when the connection is no longer needed.

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Rootly can't reach the MCP endpoint" icon="plug-circle-xmark">
    Confirm the endpoint is public, uses HTTPS, and ends in `/services/mcp`, a localized Splunk Web proxy path such as `/en-US/splunkd/__raw/services/mcp`, or the supported Splunk Cloud Services path. Check firewall rules and allow Rootly's published IP ranges when your deployment restricts inbound traffic.
  </Accordion>

  <Accordion title="TLS certificate validation fails" icon="shield-halved">
    Install the complete certificate chain for the public MCP endpoint and confirm its hostname matches the certificate. Rootly doesn't disable certificate verification for self-signed production endpoints.
  </Accordion>

  <Accordion title="Splunk rejects the token" icon="key">
    Confirm you pasted the encrypted token generated by the MCP Server app. Regular Splunk API tokens and HTTP Event Collector tokens don't work with this connector. Generate a replacement if the token expired, was revoked, or was invalidated by an MCP Server key rotation.
  </Accordion>

  <Accordion title="The connection check says splunk_run_query is missing" icon="magnifying-glass">
    Open the MCP Server app and enable the core `splunk_run_query` tool. Confirm the connector user's role includes `mcp_tool_execute` and access to the MCP APIs, then reconnect.
  </Accordion>

  <Accordion title="A search returns no events or an authorization error" icon="lock">
    Check the connector user's role, index restrictions, search filters, and time range in Splunk. Rootly AI can't search an index or use a command that Splunk blocks for that user.
  </Accordion>

  <Accordion title="Searches time out or return truncated results" icon="clock">
    Narrow the time range, filter by index and sourcetype, aggregate before returning raw events, or adjust the MCP Server guardrails if your Splunk administrator approves. Splunk's timeout, row-limit, workload, and rate-limit settings remain authoritative.
  </Accordion>

  <Accordion title="Alert tools are unavailable" icon="bell">
    Upgrade MCP Server for Splunk Platform to version 2.0.0, where Splunk added alert-discovery and alert-throttling tools. Confirm those tools are enabled in the MCP Server app and permitted for the connector user's role.
  </Accordion>
</AccordionGroup>

***

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Can Rootly AI modify Splunk data or configuration?" icon="lock">
    Rootly blocks MCP tool names it hasn't reviewed, including user administration, token management, custom tools, and other management operations. Rootly doesn't independently validate the SPL sent through `splunk_run_query`. Splunk's allowed-command list and the dedicated user's permissions determine whether a search can write data, so exclude write-capable commands and keep that user restricted.
  </Accordion>

  <Accordion title="Can I use a regular Splunk API or HEC token?" icon="key">
    No. The connector requires an encrypted token generated in the Splunk MCP Server app. Splunk restricts that token to MCP authentication.
  </Accordion>

  <Accordion title="Does this connector query Splunk Observability Cloud?" icon="chart-line">
    No. This connector targets Splunk Enterprise and Splunk Cloud Platform through the official MCP Server app or supported Splunk Cloud Services endpoint. It doesn't configure the separate Splunk Observability Cloud MCP gateway.
  </Accordion>

  <Accordion title="How do I limit which Splunk data Rootly AI sees?" icon="filter">
    Limit the dedicated Splunk user's role. Restrict its indexes, search commands, knowledge objects, and alert access to the operational data needed for incident investigation, then test the same user in Splunk before connecting it to Rootly.
  </Accordion>
</AccordionGroup>

***

## Related Pages

<CardGroup cols={3}>
  <Card title="Connectors Overview" icon="sparkles" href="/ai/connectors/overview">
    See every AI connector and how Rootly AI combines their evidence.
  </Card>

  <Card title="Splunk Alert Source" icon="bell" href="/integrations/splunk">
    Send Splunk alerts into Rootly for routing, paging, and incident workflows.
  </Card>

  <Card title="Data Privacy for Rootly AI" icon="shield" href="/ai/data-privacy-for-rootly-ai">
    Review Rootly AI's data access, retention, and training controls.
  </Card>
</CardGroup>