{
 "categories": [
  "observability",
  "enterprise",
  "developer-tools"
 ],
 "deployment": "hybrid",
 "evidence": [
  {
   "date": "2026-08-30",
   "fact": "homepage",
   "note": "Splunk presents Splunk Enterprise as the on-premises search, index, and visualize platform.",
   "source": "https://www.splunk.com/en_us/products/splunk-enterprise.html",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "deployment",
   "note": "Splunk Cloud Platform is the SaaS counterpart. This record covers both as Splunk platform.",
   "source": "https://www.splunk.com/en_us/products/splunk-cloud-platform.html",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "platforms",
   "note": "Enterprise CLI documentation covers Windows, *nix, and Mac. Cloud is a web service.",
   "source": "https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/administer-splunk-enterprise-with-the-command-line-interface-cli/about-the-cli",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "license",
   "note": "Splunk Enterprise is a commercial product. Trials exist; they are not a free production license.",
   "source": "https://www.splunk.com/en_us/products/splunk-enterprise.html",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.exists",
   "note": "Splunk documents a REST API on the management port using GET, POST, and DELETE with XML or JSON.",
   "source": "https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/9.0/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.kinds[0]",
   "note": "The documented interface is a REST architectural style.",
   "source": "https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/9.0/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.auth[0]",
   "note": "JWT authentication tokens are sent as Authorization: Bearer.",
   "source": "https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/9.0/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.auth[1]",
   "note": "A session key from POST /services/auth/login is sent as Authorization: Splunk <sessionKey>.",
   "source": "https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/9.0/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.auth[2]",
   "note": "HTTP basic authentication per RFC 1945 is documented.",
   "source": "https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/9.0/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.api.coverage",
   "note": "Cloud REST is search-tier only, needs IP allowlisting or Support opening 8089, and is unavailable on trial Cloud.",
   "source": "https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-tutorials/10.4/rest-api-tutorials/access-requirements-and-limitations-for-the-splunk-cloud-platform-rest-api",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.sdk.exists",
   "note": "Splunk documents official SDKs for Python, Java, and JavaScript that wrap the REST API.",
   "source": "https://dev.splunk.com/enterprise/docs/devtools",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.mcp.first_party",
   "note": "Splunk documents MCP Server for Splunk platform as GA infrastructure as of 1.0.0. New deployments must use the Splunkbase app. Some tools remain preview or beta.",
   "source": "https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.cli.exists",
   "note": "The official Enterprise CLI lives at $SPLUNK_HOME/bin/splunk and is documented as an alternative to REST without curl.",
   "source": "https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/administer-splunk-enterprise-with-the-command-line-interface-cli/about-the-cli",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.extensibility.scripting[0]",
   "note": "SPL is the documented search language for Enterprise and Cloud Platform.",
   "source": "https://help.splunk.com/en/splunk-cloud-platform/search/search-manual/10.1.2507/search-overview/about-the-search-language",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.extensibility.scripting[1]",
   "note": "Splunk documents apps, custom REST endpoints, and custom search commands as extension points.",
   "source": "https://dev.splunk.com/enterprise/docs/welcome/",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.extensibility.webhooks",
   "note": "The developer welcome page documents alert webhooks.",
   "source": "https://dev.splunk.com/enterprise/docs/welcome/",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.data_access.export[0]",
   "note": "SDK and REST result encodings include JSON, XML, and CSV.",
   "source": "https://dev.splunk.com/enterprise/docs/devtools",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "modalities.data_access.import[0]",
   "note": "HTTP Event Collector is documented as an ingest path.",
   "source": "https://dev.splunk.com/enterprise/docs/welcome/",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "verdict.scores.api",
   "note": "Mature REST plus search jobs and three auth methods. Cloud search-tier and trial blocks are applied inside the score.",
   "source": "https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/9.0/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "verdict.scores.mcp",
   "note": "Official GA server with useful SPL tools, instance-local install, preview tools, and query guardrails.",
   "source": "https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/1.3/mcp-server-tools",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "verdict.scores.cli",
   "note": "Official Enterprise CLI wraps REST. A Cloud-specific CLI manual was not established.",
   "source": "https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/administer-splunk-enterprise-with-the-command-line-interface-cli/about-the-cli",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "freshness.watch[0].url",
   "note": "Opened and verified as Splunk's current MCP Server for Splunk platform overview, including the GA 1.0.0 statement and SCS deprecation.",
   "source": "https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "freshness.watch[1].url",
   "note": "Opened and verified as the current MCP tool table, including preview find_data_source and SPL guardrails.",
   "source": "https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/1.3/mcp-server-tools",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "freshness.watch[2].url",
   "note": "Opened Splunkbase app 7931, MCP Server for Splunk platform, Splunk Supported. Marketplace copy still says beta; help.splunk.com is the GA source for infrastructure.",
   "source": "https://splunkbase.splunk.com/app/7931",
   "tier": "declared"
  },
  {
   "date": "2026-08-30",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current REST API basic-concepts page covering token, session-key, and basic auth.",
   "source": "https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/9.0/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-08-30",
  "volatility": "high",
  "watch": [
   {
    "type": "mcp",
    "url": "https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform"
   },
   {
    "type": "mcp",
    "url": "https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/1.3/mcp-server-tools"
   },
   {
    "type": "registry",
    "url": "https://splunkbase.splunk.com/app/7931"
   },
   {
    "type": "docs",
    "url": "https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/9.0/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api"
   }
  ]
 },
 "homepage": "https://www.splunk.com/en_us/products/splunk-enterprise.html",
 "id": "splunk",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": "unknown"
  },
  "api": {
   "auth": [
    "authentication-token",
    "session-key",
    "basic"
   ],
   "coverage": "partial",
   "docs": "https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-user-manual/9.0/rest-api-user-manual/basic-concepts-about-the-splunk-platform-rest-api",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": true
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "json",
    "xml",
    "csv"
   ],
   "import": [
    "hec"
   ]
  },
  "extensibility": {
   "scripting": [
    "spl",
    "splunk-apps"
   ],
   "webhooks": true
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. REST search jobs, SPL, the official MCP Server app, and the Enterprise CLI cover practical search and knowledge-object work without browser control.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": true,
   "languages": [
    "python",
    "java",
    "javascript"
   ],
   "official": true
  }
 },
 "name": "Splunk platform",
 "platforms": [
  "windows",
  "linux",
  "macos",
  "web"
 ],
 "related": {
  "alternatives": [
   "datadog",
   "grafana",
   "dynatrace"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Splunk (Cisco)",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 8,
   "cli": 7,
   "computer_use": null,
   "integrations": null,
   "mcp": 7,
   "overall": 8,
   "rpa": null
  },
  "summary": "Splunk platform, meaning Splunk Enterprise and Splunk Cloud Platform and not Observability Cloud or AppDynamics, is automatable today through the management-port REST API and SPL. Agents authenticate with JWT tokens, a session key from POST /services/auth/login, or HTTP basic. Enterprise coverage matches Splunk Web. Cloud REST is a search-tier subset, needs IP allowlisting or Support opening port 8089, and is unavailable on free-trial Cloud. Official Python, Java, and JavaScript SDKs wrap the REST API. The official MCP Server for Splunk platform app is GA infrastructure as of 1.0.0 and must be installed from Splunkbase for new deployments; the legacy SCS endpoint is deprecated. Tools cover SPL and SPL2 search, indexes, users, KV store, and knowledge objects, with RBAC and encrypted tokens that cannot be reused on the REST API. find_data_source is preview. splunk_run_query is guarded against unsafe commands, one-minute runtime, and 1000 events. The Enterprise splunk CLI is an official alternative to curl. This record does not merge Splunk Observability Cloud. Computer-use viability is unassessed. API scores 8 and is the best path.\n"
 }
}