---
title: Splunk MCP
description: >-
  Bits queries Splunk logs and telemetry to surface relevant events during
  investigations.
breadcrumbs: Docs > Integrations > Splunk MCP
---

# Splunk MCP
Integration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

The Datadog–Splunk integration is an MCP-based integration that enables Datadog to securely access a [Splunk MCP server instance](https://splunkbase.splunk.com/app/7931). Through this integration, the Bits AI SRE agent is granted access to designated Splunk indexes and data sources that are exposed via the available MCP tools.

During the Preview period, Bits AI SRE investigations that include one or more Splunk tool calls will not be billed.

## Setup{% #setup %}

### Prerequisites{% #prerequisites %}

Your Splunk MCP Server must be hosted on Splunk Cloud and available from the public internet. See the Splunk instructions for [enabling the MCP in your Splunk configuration](https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/configure-the-splunk-mcp-server).

### Create an encrypted authentication token{% #create-an-encrypted-authentication-token %}

Follow the Splunk instructions to [create an encrypted authentication token](https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/connecting-to-the-mcp-server-and-settings#step-1-create-an-encrypted-authentication-token-for-your-client-0).

### Allow Datadog IP addresses to reach your Splunk MCP server{% #allow-datadog-ip-addresses-to-reach-your-splunk-mcp-server %}

To let Datadog connect to your Splunk MCP server, you must add Datadog's IP addresses to the `search-api` feature allow list on your Splunk Cloud stack.

1. Retrieve the current Datadog IP addresses from the [Datadog IP ranges endpoint](https://docs.datadoghq.com/api/latest/ip-ranges.md). Use the IP addresses listed under the `webhooks` key in the response.
1. Add those IP addresses to the `search-api` feature allow list by following the Splunk instructions for [configuring IP allow lists for Splunk Cloud Platform](https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/9.2.2406/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/configure-ip-allow-lists-for-splunk-cloud-platform#ariaid-title1).

### Connect your Splunk MCP Server account to Datadog{% #connect-your-splunk-mcp-server-account-to-datadog %}

1. Add your Splunk MCP server URL (which typically uses port 8089) and encrypted token
| Parameters                                                         | Description                                                                                                                |
| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------- |
| Account name                                                       | Choose a name that will help you identify this account later.                                                              |
| Splunk MCP Server URL                                              | This is the URL for your MCP server. Example: https://{stack-name}.splunkcloud.com:8089/services/mcp                       |
| Description of the account scope                                   | Provide additional context that will help Bits AI SRE understand which aspects of your infrastructure this account covers. |
| The Splunk MCP Encrypted Token used to connect to your MCP server. | The token value from above.                                                                                                |
1. Click the **Save** button to save your settings.
1. In [Bits.md](https://app.datadoghq.com/bits-ai/settings/bits-md), fill in the **Third-Party Integration Context** snippet to help Bits make better use of this account's data during investigations.

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).