Asked my Splunk Enterprise server a question in Claude Desktop today. Got a live answer back in seconds.

Asked my Splunk Enterprise server a question in Claude Desktop today. Got a live answer back in seconds.

No SPL. No dashboard hunting. Just natural language straight to my Splunk data — inside the same tool I'm already using to write code, plan infrastructure, and reason about problems.

Getting there took some work. Claude Desktop and Claude Code are separate ecosystems with separate configs. Desktop doesn't source your shell profile, so tokens and env vars have to be explicitly passed via the mcpServers block. Throw in a self-signed cert and mcp-remote as a stdio-to-HTTPS bridge, and there's enough moving parts to get wrong.

But once it's wired up? You stop context-switching. You stop writing SPL from memory. You ask a question, you get an answer, you move on.

Next on the list: Splunk's own AI Assistant for SPL — their native take on natural language to search. Curious how it compares to querying through Claude once you've got the MCP layer in place.

Full write-up: https://lnkd.in/gZgc6QbM

What would change in your workflow if you could just ask your observability stack a question?

#splunk #claude #mcp #aiops