I gave Claude Code a live Splunk lab and said "figure out why queries hang."
3 Apr 2026
Originally published on LinkedIn ↗
I gave Claude Code a live Splunk lab and said "figure out why queries hang."
It traced the issue end-to-end: Docker logs → MCP server source → the upstream GitHub repo. The root cause? A single McpServer instance shared across all SSE connections. Every new client connect() call invalidates every other active session — so two concurrent clients (Claude Code + the lab's chat service) just keep killing each other in a loop.
Claude didn't just find it. It forked the repo, wrote the fix, pushed the branch, drafted the PR description, rebuilt the Docker image from the patched branch, and validated the fix by querying the live Splunk instance.
The whole thing — diagnosis, code fix, PR, rebuild, test — one conversation.
What struck me most: it reasoned through MCP SDK internals, identified a race condition in someone else's code, and proposed a minimal correct fix without being pointed at the right files. That's not autocomplete. That's a debugging partner.
The lab itself is open source — a self-contained Splunk + MCP environment for experimenting with AI-powered observability workflows. If that's your kind of thing, come follow along or contribute.
#Splunk #AI #MCP #Homelab
