Connect Claude to Splunk MCP Server

Register the Splunk MCP Server.

1. Run the following command on your workstation. Replace the placeholders with the values from your administrator:

   CODECopy

   claude mcp add --transport http \ --callback-port <callback-port> \ --client-id <client-id> \ --client-secret \ splunk-mcp <mcp-endpoint>

   claude mcp add --transport http \ 
      --callback-port <callback-port> \ 
      --client-id <client-id> \ 
      --client-secret \ 
      splunk-mcp <mcp-endpoint>

2. When prompted, paste the Client secret:

   1. The <callback-port> must exactly match the port in the Redirect URI your administrator configured in Splunk.

   2. The <client-id> is the Client ID from the Splunk OAuth client.

   3. The <mcp-endpoint> is the HTTP endpoint of the Splunk MCP Server.

      For Splunk Observability tools using the MCP Gateway and Unified Identity, include the splunk_tenant header. You can also include the X-SPLUNK-O11Y-TOOL-SETS header to make additional Splunk Observability toolsets available to Claude Code.

      For example:

      CODECopy

      claude mcp add \ --transport http \ --callback-port <callback-port> \ --client-id <client-id> \ --client-secret \ splunk-mcp <mcp-gateway-endpoint> \ --header "splunk_tenant: <splunk-tenant>" \ --header "X-SPLUNK-O11Y-TOOL-SETS: apm,metrics,dashboards,detectors"

      claude mcp add \ 
      --transport http \ 
      --callback-port <callback-port> \ 
      --client-id <client-id> \ 
      --client-secret \ 
      splunk-mcp <mcp-gateway-endpoint> \ 
      --header "splunk_tenant: <splunk-tenant>" \ 
      --header "X-SPLUNK-O11Y-TOOL-SETS: apm,metrics,dashboards,detectors"

      Note: Specify the server name and MCP Gateway endpoint before the --header options. In Claude Code, the --header option can consume following arguments if the headers appear earlier in the command.

Restrict OAuth scopes. Open Claude Code's configuration file (~/.claude.json) and locate the splunk-mcp entry. Claude Code does not currently provide a command-line option for configuring OAuth scopes.

Add a scopes field inside the OAuth block, set to openid offline_access:

"splunk-mcp": { 
   "type": "http", 
   "url": "<mcp-endpoint>", 
   "oauth": { 
     "clientId": "<client-id>", 
     "callbackPort": <callback-port>, 
     "scopes": "openid offline_access" 
   } 
}

Authenticate:

1. Start Claude Code: claude

2. From inside Claude Code run: /mcp

3. Your browser opens to the Splunk sign-in page.

4. Sign in with your Splunk credentials and approve access for the Claude Code application.

5. The browser redirects to http://localhost:<callback-port>/callback and Claude Code completes authentication.

Verify tools:

1. Run /mcp again to confirm splunk-mcp is connected.

2. Review the list of tools exposed by the Splunk MCP Server.

3. Invoke any tool to validate end-to-end connectivity. For example, a read-only search tool.