Merge Unified's Splunk integration Merge Agent Handler's Splunk MCP server

Connect your AI Agents to Splunk in minutes

Merge lets you securely connect your agents to Splunk and thousands of tools instantly

Start building for free

Read docs

Splunk

Learn more about Merge Agent Handler

Available tools

list_fired_alerts

List fired-alert groups (one per saved search that has triggered). Returns names used by getfiredalertsforsearch and deletefiredalerts.

get_fired_alerts_for_search

List the triggered-alert records for one saved search by name; each entry's name is the alert id deletefiredalerts takes. Use listfiredalerts to find search names.

delete_fired_alerts

Delete one scheduler-fired alert record by its alert id (ids start with 'scheduler'; Splunk rejects records from a manual dispatch). Use getfiredalertsforsearch to find ids.

list_alert_actions

List available alert actions (email, webhook, script, ...). Returns names used by getalertaction and by createsavedsearch's 'actions' field.

get_alert_action

Get configuration for one alert action by name, e.g. 'email'. Use listalertactions to find names.

list_dashboards

List dashboards/views. Filter by name substring with 'search'. Returns names used by get_dashboard.

get_dashboard

Get a dashboard/view by name, including its XML/definition. Use list_dashboards to find names.

list_eventtypes

List event types. Returns names used by geteventtype and updateeventtype, and usable as 'eventtype=NAME' in SPL.

create_eventtype

Create an event type. Requires a unique name and the defining search expression.

get_eventtype

Get an event type by name, including its defining search. Use list_eventtypes to find names.

update_eventtype

Update an event type's search, priority, or disabled state by name. Only provided fields change. Use list_eventtypes to find names.

delete_eventtype

Delete an event type by name. Use list_eventtypes to find names.

list_hec_tokens

List HTTP Event Collector (HEC) tokens/inputs. Returns names used by gethectoken and updatehectoken.

create_hec_token

Create an HTTP Event Collector token. Only the name is required. Reference indexes discoverable via list_indexes.

get_hec_token

Get an HTTP Event Collector token by name, including its token value and index settings. Use listhectokens to find names.

update_hec_token

Update an HTTP Event Collector token's index, sourcetype, or disabled state by name. Only provided fields change. Use listhectokens to find names.

delete_hec_token

Delete an HTTP Event Collector token by name. Use listhectokens to find names.

list_apps

List installed apps. Filter by name substring with 'search'. Returns names used by get_app.

get_app

Get an installed app by name, including its version and label. Use list_apps to find names.

list_users

List Splunk user accounts. Filter by username substring with 'search'. Returns names used by get_user.

get_user

Get a Splunk user by username, including roles and email. Use list_users to find names.

list_roles

List Splunk roles. Returns names used by get_role, and the capabilities/index grants each role carries.

get_role

Get a Splunk role by name, including its capabilities and index access. Use list_roles to find names.

list_capabilities

List all capabilities available on the deployment (the permission atoms roles are built from).

list_auth_tokens

List authentication (JWT) tokens. Filter by owner with 'username'. Returns names used by deleteauthtoken.

create_auth_token

Create an authentication (JWT) token for a user. Requires the owner username (name) and an audience label. Use list_users to find usernames.

delete_auth_token

Delete (revoke) an authentication token by owner username. Pass 'id' to target a specific token. Use listauthtokens to find names.

list_indexes

List data indexes. Filter by name substring with 'search' or by 'datatype'. Returns names used by getindex, updateindex, and referenced in SPL.

create_index

Create a data index. Only the name is required; datatype defaults to 'event'. Use list_indexes to check existing names first.

get_index

Get a data index by name, including retention and size settings. Use list_indexes to find names.

update_index

Update a data index's size, retention, or disabled state by name. Only provided fields change. Use list_indexes to find names.

delete_index

Delete a data index by name. This removes the index and its data. Use list_indexes to find names.

list_tags

List tags defined in the search app. Returns names used by get_tag and usable as 'tag=NAME' in SPL.

get_tag

Get a tag by name, including the field::value pairs it maps. Use list_tags to find names.

list_field_extractions

List field extractions (EXTRACT/REPORT). Returns names used by getfieldextraction and deletefieldextraction.

create_field_extraction

Create a field extraction. All of name, type (EXTRACT/REPORT), value, and stanza are required. The stanza is a host/source/sourcetype name; discover valid sourcetypes with export_search on '| metadata type=sourcetypes index=*'.

get_field_extraction

Get a field extraction by name, including its type and regex/stanza. Use listfieldextractions to find names.

delete_field_extraction

Delete a field extraction by name. Use listfieldextractions to find names.

list_kvstore_collections

List KV store collection definitions in a namespace (owner/app). Returns names used by getkvstorecollection and by the KV data tools.

create_kvstore_collection

Create a KV store collection in a namespace (owner/app). Only the name is required; field types and acceleration are optional.

get_kvstore_collection

Get a KV store collection definition by name in a namespace (owner/app). Use listkvstorecollections to find names.

update_kvstore_collection

Update a KV store collection's field types or acceleration by name in a namespace. Only provided fields change. Use listkvstorecollections to find names.

delete_kvstore_collection

Delete a KV store collection (and all its records) by name in a namespace. Use listkvstorecollections to find names.

query_kvstore_records

Query documents in a KV store collection with an optional Mongo-style filter, field projection, and sort. Returns documents keyed by key. Use listkvstore_collections to find collection names.

insert_kvstore_record

Insert one document into a KV store collection (JSON body). Returns the new key. Include 'key' in the document to set it explicitly. Use listkvstorecollections to find collection names.

get_kvstore_record

Get a single KV store document by its key. Use querykvstorerecords to find keys and listkvstore_collections to find collection names.

update_kvstore_record

Replace a KV store document by its key with a new document (JSON body). Use querykvstore_records to find keys.

delete_kvstore_records

Delete documents from a KV store collection matching an optional filter. With no query ALL documents are removed. Use listkvstorecollections to find collection names.

delete_kvstore_record

Delete a single KV store document by its key. Use querykvstore_records to find keys.

batch_save_kvstore_records

Insert or update many KV store documents in one call (JSON array body); include 'key' to update an existing document. Use listkvstore_collections to find collection names.

list_lookups

List lookup-table definitions. Returns names used by getlookup and updatelookup, and referenceable in SPL 'lookup' commands.

create_lookup

Create a lookup-table definition. Only the name is required; type defaults to 'file'. For kvstore lookups, find collection names with listkvstorecollections.

get_lookup

Get a lookup-table definition by name. Use list_lookups to find names.

update_lookup

Update a lookup-table definition's file, collection, or field list by name. Only provided fields change. Use list_lookups to find names.

delete_lookup

Delete a lookup-table definition by name. Use list_lookups to find names.

list_macros

List search macros. Returns names used by getmacro and updatemacro, and referenceable in SPL with backticks.

create_macro

Create a search macro. Requires a name (with arg count in parentheses if it takes args) and the SPL definition.

get_macro

Get a search macro by name, including its definition. Use list_macros to find names.

update_macro

Update a search macro's definition or arguments by name. Only provided fields change. Use list_macros to find names.

delete_macro

Delete a search macro by name. Use list_macros to find names.

list_saved_searches

List saved searches (reports and alerts). Filter by name substring with 'search'. Returns names used by getsavedsearch, updatesavedsearch, dispatchsavedsearch.

create_saved_search

Create a saved search. Requires a unique name and the SPL. Index/field names referenced in the SPL can be discovered with list_indexes.

get_saved_search

Get a saved search by name, including its SPL and schedule. Use listsavedsearches to find names.

update_saved_search

Update a saved search's SPL, schedule, or alert settings by name. Only provided fields change. Use listsavedsearches to find names.

delete_saved_search

Delete a saved search by name. Use listsavedsearches to find names.

dispatch_saved_search

Run a saved search now, creating a new search job. Returns the job id (sid) for getsearchresults. The saved SPL (and its alert actions, if triggered) can write data, so treat this as a write. Use listsavedsearches to find names.

get_saved_search_history

List the past search jobs dispatched from a saved search, by name. Use listsavedsearches to find names.

list_search_jobs

List search jobs on the deployment. Filter by SPL substring with 'search'. Returns job ids (sid) for getsearchjob and getsearchresults.

create_search_job

Dispatch a new search job from SPL. Returns the job id (sid); poll with getsearchjob and read output with getsearchresults. Set execmode='blocking' to wait for completion, or use exportsearch for inline results. SPL can write data (outputlookup, collect, delete), so treat this as a write.

get_search_job

Get the status and metadata of a search job by its id (sid). Use listsearchjobs or createsearchjob to find the sid.

delete_search_job

Delete (cancel and remove) a search job by its id (sid). Use listsearchjobs to find the sid.

control_search_job

Control a running search job: pause, unpause, finalize, cancel, touch, setttl, setpriority, save, or unsave. Use listsearchjobs to find the sid.

get_search_results

Get the transformed results of a completed search job by its sid. Supports pagination (count/offset) and post-process SPL via 'search'. Use createsearchjob first.

get_search_results_preview

Get preview (partial) results of a still-running search job by its sid. Use createsearchjob first; for final results use getsearchresults.

get_search_events

Get the raw matching events (pre-transformation) of a search job by its sid, with optional time-range and field filters. Use createsearchjob first.

get_search_summary

Get the field summary (per-field statistics) for a search job by its sid. The job must be created with statusbuckets set (createsearch_job); otherwise the summary is empty.

get_search_timeline

Get the event-timeline buckets for a search job by its sid. The job must be created with statusbuckets set (createsearch_job); otherwise no buckets are returned.

export_search

Run SPL and stream back matching results in one call without persisting a job. Good for one-off queries. Returns at most 100 rows by default (cap 10000). SPL can write data (outputlookup, collect, delete), so treat this as a write. For long-running work use createsearchjob plus getsearchresults.

get_server_info

Get deployment server info: version, build, GUID, OS, and hardware. Also used to validate connectivity.

get_server_settings

Get deployment server settings: ports, SPLUNK_DB path, SSL, and session timeout.

get_server_health

Get the splunkd health report (overall green/yellow/red and red/yellow feature counts).

list_server_messages

List system bulletin messages (banner notices such as disk-space or crash warnings).

validate_credential

Validate Splunk credentials and connectivity by fetching server info. Returns success and a message.

View all tools by creating a free account See more tools

How to set up Merge Agent Handler

In an mcp.json file, add the configuration below, and restart Cursor.

Learn more in the official documentation ↗

1{
2  "mcpServers": {
3    "agent-handler": {
4      "url": "https://ah-api-develop.merge.dev/api/v1/tool-packs/{TOOL_PACK_ID}/registered-users/{REGISTERED_USER_ID}/mcp",
5      "headers": {
6        "Authorization": "Bearer yMt*****"
7      }
8    }
9  }
10}
11

Copy Code

Open your Claude Desktop configuration file and add the server configuration below. You'll also need to restart the application for the changes to take effect.

Make sure Claude is using the Node v20+.

Learn more in the official documentation ↗

1{
2  "mcpServers": {
3    "agent-handler": {
4      "command": "npx",
5      "args": [
6        "-y",
7        "mcp-remote@latest",
8        "https://ah-api-develop.merge.dev/api/v1/tool-packs/{TOOL_PACK_ID}/registered-users/{REGISTERED_USER_ID}/mcp",
9        "--header",
10        "Authorization: Bearer ${AUTH_TOKEN}"
11      ],
12      "env": {
13        "AUTH_TOKEN": "yMt*****"
14      }
15    }
16  }
17}

Copy Code

Open your Windsurf MCP configuration file and add the server configuration below.
Click on the refresh button in the top right of the Manage MCP server page or in the top right of the chat box in the box icon.

Learn more in the official documentation ↗

1{
2    "mcpServers": {
3      "agent-handler": {
4        "command": "npx",
5        "args": [
6          "-y",
7          "mcp-remote@latest",
8          "https://ah-api.merge.dev/api/v1/tool-packs/<tool-pack-id>/registered-users/<registered-user-id>/mcp",
9          "--header",
10          "Authorization: Bearer ${AUTH_TOKEN}"
11        ],
12        "env": {
13          "AUTH_TOKEN": "<ah-production-access-key>"
14        }
15      }
16    }
17  }

Copy Code

In Command Palette (Cmd+Shift+P on macOS, Ctrl+Shift+P on Windows), run "MCP: Open User Configuration".

You can then add the configuration below and press "start" right under servers. Enter the auth token when prompted.

Learn more in the official documentation ↗

1{
2  "inputs": [
3    {
4      "type": "promptString",
5      "id": "agent-handler-auth",
6      "description": "Agent Handler AUTH_TOKEN", // "yMt*****" when prompt
7      "password": true
8    }
9  ],
10  "servers": {
11    "agent-handler": {
12      "type": "stdio",
13      "command": "npx",
14      "args": [
15        "-y",
16        "mcp-remote@latest",
17        "https://ah-api-develop.merge.dev/api/v1/tool-packs/{TOOL_PACK_ID}/registered-users/{REGISTERED_USER_ID}/mcp",
18        "--header",
19        "Authorization: Bearer ${input:agent-handler-auth}"
20      ]
21    }
22  }
23}