splunkctl

Operate Splunk Enterprise, Enterprise Security, and Splunk SOAR from a terminal, or give an AI agent the same commands through MCP.

Requires Python 3.12+ and credentials for your Splunk instance.

Quickstart

python -m pip install splunkctl
splunkctl config init
splunkctl doctor

Documentation · Installation requirements

Tasks

• Investigate: run SPL, read fired alerts, and triage Enterprise Security notables. Search, Triage notables
• Deploy detections: export saved searches to YAML, review the diff, and import them on another instance. Manage detection rules
• Respond with SOAR: work containers, artifacts, vault files, notes, and playbook runs. Work SOAR incidents
• Review configuration drift: pull live state, diff it against version control, and push approved changes with a change report. Manage configuration as code

Safety

Every command…