For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/integrations/splunk-mcp.md. A documentation index is available at /llms.txt.

Splunk MCP

Integration version1.0.0

To find out if this integration is available in your organization, see your Datadog Integrations page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email support@ddog-gov.com.

Overview

The Datadog–Splunk integration is an MCP-based integration that enables Datadog to securely access a Splunk MCP server instance. Through this integration, the Bits AI SRE agent is granted access to designated Splunk indexes and data sources that are exposed via the available MCP tools.

During the Preview period, Bits AI SRE investigations that include one or more Splunk tool calls will not be billed.

Setup

Prerequisites

Your Splunk MCP Server must be hosted on Splunk Cloud and available from the public internet. See the Splunk instructions for enabling the MCP in your Splunk configuration.

Create an encrypted authentication token

Follow the Splunk instructions to create an encrypted authentication token.

Allow Datadog IP addresses to reach your Splunk MCP server

To let Datadog connect to your Splunk MCP server, you must add Datadog’s IP addresses to the search-api feature allow list on your Splunk Cloud stack.

  1. Retrieve the current Datadog IP addresses from the Datadog IP ranges endpoint. Use the IP addresses listed under the webhooks key in the response.
  2. Add those IP addresses to the search-api feature allow list by following the Splunk instructions for configuring IP allow lists for Splunk Cloud Platform.

Connect your Splunk MCP Server account to Datadog

  1. Add your Splunk MCP server URL (which typically uses port 8089) and encrypted token
    ParametersDescription
    Account nameChoose a name that will help you identify this account later.
    Splunk MCP Server URLThis is the URL for your MCP server. Example: https://{stack-name}.splunkcloud.com:8089/services/mcp
    Description of the account scopeProvide additional context that will help Bits AI SRE understand which aspects of your infrastructure this account covers.
    The Splunk MCP Encrypted Token used to connect to your MCP server.The token value from above.
  2. Click the Save button to save your settings.
  3. In Bits.md, fill in the Third-Party Integration Context snippet to help Bits make better use of this account’s data during investigations.

Troubleshooting

Need help? Contact Datadog support.