From hours to minutes: how AI speeds up Splunk insights

From manual steps to conversations

For years, I’ve been working with Splunk—first as a developer/admin, then as an architect, and later building automation tools to manage large environments.

If you’ve ever deployed apps, managed forwarders, or troubleshot slow searches during an incident, you know the drill:

You log in.
You search.
You filter.
You tweak your SPL.
You repeat.

Sometimes, it takes hours to answer simple questions like: “Why did this alert fire again?” or “Has this index received any data in the last day?”

It’s not that Splunk can’t answer these questions—it can. But the process is manual and disconnected. You need to know where to look, what to search for, and how to stitch it all together.

That model is about to change.

How AI changes the game

When ChatGPT arrived, many of us wondered: “Can this write my SPL?” It could—sort of. It could also analyze and summarize results if you fed them in. But it felt like having a brilliant intern locked in another room. There was a fundamental disconnect between AI’s reasoning and Splunk’s data.

The AI and Splunk were separate islands with no bridge between them. You had to copy-paste, re-explain, and reset context constantly. Helpful, but not integrated. This raised a bigger question: What if your AI could talk directly to Splunk?

Imagine asking:

“Show me all failed login attempts from external IPs in the last hour."
"Is the new app rollout causing errors in production?”
“Generate a list of indexes that haven’t received data in 30 days.”

And the AI just answers. It understands intent, runs the right searches, and provides secure, real-time responses. To make that happen, we don’t need a smarter chatbot, we need better plumbing. Enter the model context protocol (MCP).

MCP: the universal connector for AI

Think of MCP as a universal adapter for AI, introduced by Anthropic. Just like a USB-C port allows you to connect chargers, monitors, and drives without needing custom ports, MCP provides a standardized, secure way for AI (the client) to communicate with any system (the server).

With MCP, instead of fragile, one-off integrations, you get a standard communication layer. Build an MCP server for Splunk, and any compatible AI tool can securely ask questions, interpret data, and take action.

At Deslicer, we’re building a production-grade MCP server for Splunk, a secure bridge that respects Splunk access controls while enabling your AI assistant to work directly with your data.

From automation to conversational automation

Prescriptive automation (installing clusters, deploying apps at scale, zero-downtime upgrades) remains the foundation. But MCP unlocks conversational automation. Instead of rigid playbooks, you have a dynamic conversation with your environment.

The shift from manual steps to intent-driven questions reduces cognitive load, freeing you to focus on action rather than searching for data.

How it fits in Splunk

Here’s how the flow works in practice:

A Splunker asks a natural language question.
The AI assistant (MCP client) sends the request to our MCP server.
The server translates the request into secure actions against Splunk, respecting all role-based access control (RBAC) rules.

The AI only sees and does what the user is authorized to do. Simple. Secure. Effective. This is the future of interacting with data, and it’s happening now.