---
title: Splunk MCP
description: >-
  Bits queries Splunk logs and telemetry to surface relevant events during
  investigations.
breadcrumbs: Docs > Integrations > Splunk MCP
---

# Splunk MCP
Integration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

The Datadog–Splunk integration is an MCP-based integration that enables Datadog to securely access a [Splunk MCP server instance](https://splunkbase.splunk.com/app/7931). Through this integration, the Bits AI SRE agent is granted access to designated Splunk indexes and data sources that are exposed via the available MCP tools.

## Setup{% #setup %}

### Prerequisites{% #prerequisites %}

Your Splunk MCP Server must be hosted on Splunk Cloud and available from the public internet. See the Splunk instructions for [enabling the MCP in your Splunk configuration](https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/configure-the-splunk-mcp-server).

### Create an encrypted authentication token{% #create-an-encrypted-authentication-token %}

Follow the Splunk instructions to [create an encrypted authentication token](https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/connecting-to-the-mcp-server-and-settings#step-1-create-an-encrypted-authentication-token-for-your-client-0).

### Allow Datadog IP addresses to reach your Splunk MCP server{% #allow-datadog-ip-addresses-to-reach-your-splunk-mcp-server %}

To let Datadog connect to your Splunk MCP server, you must add Datadog's IP addresses to the `search-api` feature allow list on your Splunk Cloud stack.

1. Retrieve the current Datadog IP addresses from the [Datadog IP ranges endpoint](https://docs.datadoghq.com/api/latest/ip-ranges.md). Use the IP addresses listed under the `webhooks` key in the response.
1. Add those IP addresses to the `search-api` feature allow list by following the Splunk instructions for [configuring IP allow lists for Splunk Cloud Platform](https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/9.2.2406/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/configure-ip-allow-lists-for-splunk-cloud-platform#ariaid-title1).

### Connect your Splunk MCP Server account to Datadog{% #connect-your-splunk-mcp-server-account-to-datadog %}

1. Add your Splunk MCP server URL (which typically uses port 8089) and encrypted token
| Parameters                                                         | Description                                                                                                                |
| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------- |
| Account name                                                       | Choose a name that will help you identify this account later.                                                              |
| Splunk MCP Server URL                                              | This is the URL for your MCP server. Example: https://{stack-name}.splunkcloud.com:8089/services/mcp                       |
| Description of the account scope                                   | Provide additional context that will help Bits AI SRE understand which aspects of your infrastructure this account covers. |
| The Splunk MCP Encrypted Token used to connect to your MCP server. | The token value from above.                                                                                                |
1. Click the **Save** button to save your settings.
1. In [Bits.md](https://app.datadoghq.com/bits-ai/settings/bits-md), fill in the **Third-Party Integration Context** snippet to help Bits make better use of this account's data during investigations.

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).