splunk-mcp-server-by-cdata

CData's Model Context Protocol (MCP) Server for Splunk

:heavy_exclamation_mark: This project builds a local, read-only MCP server. For fully remote MCP access, check out the first managed MCP platform: CData Connect AI. For locally hosted, full read, write, update, delete, and action capabilities and a simplified setup, check out our CData MCP Server for Splunk.

Purpose

We created this read-only MCP Server to allow LLMs (like Claude Desktop) to query live data Splunk supported by the CData JDBC Driver for Splunk.

CData JDBC Driver connects to Splunk by exposing them as relational SQL models.

This server wraps that driver and makes Splunk data available through a simple MCP interface, so LLMs can retrieve live information by asking natural language questions — no SQL required.

Setup Guide

1. Clone the repository:

   git clone https://github.com/cdatasoftware/splunk-mcp-server-by-cdata.git
   cd splunk-mcp-server-by-cdata
   

2. Build the server:

   mvn clean install
   

   This creates the JAR file: CDataMCP-jar-with-dependencies.jar
3. Download and install the CData JDBC Driver for {source}: https://www.cdata.com/drivers/splunk/download/jdbc
4. License the CData JDBC Driver:
   • Navigate to the lib folder in the installation directory, typically:
     • (Windows) C:\Program Files\CData\CData JDBC Driver for Splunk\
     • (Mac/Linux) /Applications/CData JDBC Driver for Splunk/
   • Run the command java -jar cdata.jdbc.splunk.jar --license
   • Enter your name, email, and "TRIAL" (or your license key).
5. Configure your connection to the data source (Salesforce as an example):

   • Run the command java -jar cdata.jdbc.splunk.jar to open the Connection String utility.

     

   • Configure the connection string and click "Test Connection"

     Note: If the data sources uses OAuth, you will need to authenticate in your browser.

   • Once successful, copy the connection string for use later.

6. Create a .prp file for your JDBC connection (e.g. splunk.prp) using the following properties and format:
   • Prefix - a prefix to be used for the tools exposed
   • ServerName - a name for your server
   • ServerVersion - a version for your server
   • DriverPath - the full path to the JAR file for your JDBC driver
   • DriverClass - the name of the JDBC Driver Class (e.g. cdata.jdbc.splunk.SplunkDriver)
   • JdbcUrl - the JDBC connection string to use with the CData JDBC Driver to connect to your data (copied from above)
   • Tables - leave blank to access all data, otherwise you can explicitly declare the tables you wish to create access for

     Prefix=splunk
     ServerName=CDataSplunk
     ServerVersion=1.0
     DriverPath=PATH\TO\cdata.jdbc.splunk.jar
     DriverClass=cdata.jdbc.splunk.SplunkDriver
     JdbcUrl=jdbc:splunk:InitiateOAuth=GETANDREFRESH;
     Tables=
     

Using the Server with Claude Desktop

1. Create the config file for Claude Desktop ( claude_desktop_config.json) to add the new MCP server, using the format below. If the file already exists, add the entry to the mcpServers in the config file.

   Windows

   {
     "mcpServers": {
       "{classname_dash}": {
         "command": "PATH\\TO\\java.exe",
         "args": [
           "-jar",
           "PATH\\TO\\CDataMCP-jar-with-dependencies.jar",
           "PATH\\TO\\splunk.prp"
         ]
       },
       ...
     }
   }
   

   Linux/Mac

   {
     "mcpServers": {
       "{classname_dash}": {
         "command": "/PATH/TO/java",
         "args": [
           "-jar",
           "/PATH/TO/CDataMCP-jar-with-dependencies.jar",
           "/PATH/TO/splunk.prp"
         ]
       },
       ...
     }
   }
   

   If needed, copy the config file to the appropriate directory (Claude Desktop as the example). Windows

   cp C:\PATH\TO\claude_desktop_config.json %APPDATA%\Claude\claude_desktop_config.json
   

   Linux/Mac

   cp /PATH/TO/claude_desktop_config.json /Users/{user}/Library/Application\ Support/Claude/claude_desktop_config.json'
   

2. Run or refresh your client (Claude Desktop).

Note: You may need to fully exit or quit your Claude Desktop client and re-open it for the MCP Servers to appear.

Running the Server

1. Run the follow the command to run the MCP Server on its own

   java -jar /PATH/TO/CDataMCP-jar-with-dependencies.jar /PATH/TO/Salesforce.prp
   

Note: The server uses stdio so can only be used with clients that run on the same machine as the server.

Usage Details

Once the MCP Server is configured, the AI client will be able to use the built-in tools to read, write, update, and delete the underlying data. In general, you do not need to call the tools explicitly. Simply ask the client to answer questions about the underlying data system. For example:

• "What is the correlation between my closed won opportunities and the account industry?"
• "How many open tickets do I have in the SUPPORT project?"
• "Can you tell me what calendar events I have today?"

The list of tools available and their descriptions follow:

Tools & Descriptions

In the definitions below, {servername} refers to the name of the MCP Server in the config file (e.g. {classname_dash} above).

• {servername}_get_tables - Retrieves a list of tables available in the data source. Use the {servername}_get_columns tool to list available columns on a table. The output of the tool will be returned in CSV format, with the first line containing column headers.
• {servername}_get_columns - Retrieves a list of columns for a table. Use the {servername}_get_tables tool to get a list of available tables. The output of the tool will be returned in CSV format, with the first line containing column headers.
• {servername}_run_query - Execute a SQL SELECT query

JSON-RPC Request Examples

If you are scripting out the requests sent to the MCP Server instead of using an AI Client (e.g. Claude), then you can refer to the JSON payload examples below – following the JSON-RPC 2.0 specification - when calling the available tools.

splunk_get_tables

{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
        "name": "splunk_get_tables",
        "arguments": {}
    }
}

splunk_get_columns

{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
        "name": "splunk_get_columns",
        "arguments": {
            "table":  "Account"
        }
    }
}

splunk_run_query

{
    "jsonrpc": "2.0",
    "id": 3,
    "method": "tools/call",
    "params": {
        "name": "splunk_run_query",
        "arguments": {
            "sql":  "SELECT * FROM [Account] WHERE [IsDeleted] = true"
        }
    }
}

Troubleshooting

1. If you cannot see your CData MCP Server in Claude Desktop, be sure that you have fully quit Claude Desktop (Windows: use the Task Manager, Mac: use the Activity Monitor)
2. If Claude Desktop is unable to retrieve data, be sure that you have configured your connection properly. Use the Connection String builder to create the connection string (see above) and copy the connection string into the property (.prp) file.
3. If you are having trouble connecting to your data source, contact the CData Support Team.
4. If you are having trouble using the MCP server, or have any other feedback, join the CData Community.

License

This MCP server is licensed under the MIT License. This means you are free to use, modify, and distribute the software, subject to the terms and conditions of the MIT License. For more details, please see the LICENSE file in the project repository.

All Supported Sources