splunk-mcp-server-by-cdata

CData's Model Context Protocol (MCP) Server for Splunk

:heavy_exclamation_mark: This project builds a local, read-only MCP server. For fully remote MCP access, check out the first managed MCP platform: CData Connect AI. For locally hosted, full read, write, update, delete, and action capabilities and a simplified setup, check out our CData MCP Server for Splunk.

Purpose

We created this read-only MCP Server to allow LLMs (like Claude Desktop) to query live data Splunk supported by the CData JDBC Driver for Splunk.

CData JDBC Driver connects to Splunk by exposing them as relational SQL models.

This server wraps that driver and makes Splunk data available through a simple MCP interface, so LLMs can retrieve live information by asking natural language questions — no SQL required.

Setup Guide

1. Clone the repository:

   git clone https://github.com/cdatasoftware/splunk-mcp-server-by-cdata.git
   cd splunk-mcp-server-by-cdata
   

2. Build the server:

   mvn clean install
   

   This creates the JAR file: CDataMCP-jar-with-dependencies.jar
3. Download and install the CData JDBC Driver for {source}: https://www.cdata.com/drivers/splunk/download/jdbc
4. License the CData JDBC Driver:
   • Navigate to the lib folder in the installation directory, typically:
     • (Windows) C:\Program Files\CData\CData JDBC Driver for Splunk\
     • (Mac/Linux) /Applications/CData JDBC Driver for Splunk/
   • Run the command java -jar cdata.jdbc.splunk.jar --license
   • Enter your name, email, and "TRIAL" (or your license key).
5. Configure your connection to the data source (Salesforce as an example):

   • Run the command java -jar cdata.jdbc.splunk.jar to open the Connection String utility.

     

   • Configure the connection string and click "Test Connection"

     Note: If the data sources uses OAuth, you will need to authenticate in your browser.

   • Once successful, copy the connection string for use later.

6. Create a .prp file for your JDBC connection (e.g. splunk.prp) using the following properties and format:
   • Prefix - a prefix to be used for the tools exposed
   • ServerName - a name for your server
   • ServerVersion - a version for your server
   • DriverPath - the full path to the JAR file for your JDBC driver
   • DriverClass - the name of the JDBC Driver Class (e.g. cdata.jdbc.splunk.SplunkDriver)
   • JdbcUrl - the JDBC connection string to use with the CData JDBC Driver to connect to your data (copied from above)
   • Tables - leave blank to access all data, otherwise you can explicitly declare the tables you wish to create access for

     Prefix=splunk
     ServerName=CDataSplunk
     ServerVersion=1.0
     DriverPath=PATH\TO\cdata.jdbc.splunk.jar
     DriverClass=cdata.jdbc.splunk.SplunkDriver
     JdbcUrl=jdbc:splunk:InitiateOAuth=GETANDREFRESH;
     Tables=
     

Using the Server with Claude Desktop

1. Create the config file for Claude Desktop ( claude_desktop_config.json) to add the new MCP server, using the format below. If the file already exists, add the entry to the mcpServers in the config file.

   Windows

   {
     "mcpServers": {
       "{classname_dash}": {
         "command": "PATH\\TO\\java.exe",
         "args": [
           "-jar",
           "PATH\\TO\\CDataMCP-jar-with-dependencies.jar",
           "PATH\\TO\\splunk.prp"
         ]
       },
       ...
     }
   }
   

   Linux/Mac

   {
   

... View full README on GitHub