Can AI agents automate Splunk platform?

Splunk platform, meaning Splunk Enterprise and Splunk Cloud Platform and not Observability Cloud or AppDynamics, is automatable today through the management-port REST API and SPL. Agents authenticate with JWT tokens, a session key from POST /services/auth/login, or HTTP basic. Enterprise coverage matches Splunk Web. Cloud REST is a search-tier subset, needs IP allowlisting or Support opening port 8089, and is unavailable on free-trial Cloud. Official Python, Java, and JavaScript SDKs wrap the REST API. The official MCP Server for Splunk platform app is GA infrastructure as of 1.0.0 and must be installed from Splunkbase for new deployments; the legacy SCS endpoint is deprecated. Tools cover SPL and SPL2 search, indexes, users, KV store, and knowledge objects, with RBAC and encrypted tokens that cannot be reused on the REST API. find_data_source is preview. splunk_run_query is guarded against unsafe commands, one-minute runtime, and 1000 events. The Enterprise splunk CLI is an official alternative to curl. This record does not merge Splunk Observability Cloud. Computer-use viability is unassessed. API scores 8 and is the best path.

Best path today: api · Overall automatability: 8/10