dannyota/splunkctl

将Splunk Enterprise和Splunk SOAR作为代码运行，配备安全优先的CLI和MCP服务器，供人类和AI代理使用。

文档 ·命令目录 ·发布

---

splunkctl 是一个开源的 Python CLI，并且 模型上下文协议（MCP）服务器 远程 Splunk Enterprise 和 Splunk SOAR 实例。交互式使用， 可以编写稳定的JSON输出，或者让MCP客户端访问相同的命令 浮出水面。

• 管理Splunk Enterprise — 搜索、检测规则、警报、索引， 输入、查找、解析器、仪表盘、应用、用户、拓扑、审计和 企业安全工作流程。
• 操作Splunk SOAR — 容器、工件、操作手册、动作、案例， 审批、资产、保险库文件、自定义列表、管理以及 SIEM-to-SOAR 吞下。
• 保持配置为代码 — 拉取活状态，审查结构化漂移， 并通过变更证据报告推动已批准的变更。
• 安全自动 — 变异预览默认，机器输出为 结构化，输入错误，显示所有目标配置文件和主机。

每个突变默认都是预演。 在你通过之前，什么都不会改变 --yes。在应用目标和拟议变更前，请先审查。

---

splunkctl is an open-source Python CLI and Model Context Protocol (MCP) server for remote Splunk Enterprise and Splunk SOAR instances. Use it interactively, script its stable JSON output, or give an MCP client access to the same command surface.

• Manage Splunk Enterprise — searches, detection rules, alerts, indexes, inputs, lookups, parsers, dashboards, apps, users, topology, audit, and Enterprise Security workflows.
• Operate Splunk SOAR — containers, artifacts, playbooks, actions, cases, approvals, assets, vault files, custom lists, administration, and SIEM-to-SOAR ingest.
• Keep configuration as code — pull live state, review structured drift, and push approved changes with change-evidence reports.
• Automate safely — mutations preview by default, machine output is structured, errors are typed, and every target profile and host is shown.

Every mutation is a dry run by default. Nothing changes until you pass --yes. Review the target and proposed change before applying it.

Install

python -m pip install splunkctl

Python 3.13 or newer is required. Core commands work with the upstream Splunk SDK installed from PyPI.

Dashboard, lookup-file, and HTTP Event Collector (HEC) token commands use entity classes provided by the optional splunkctl SDK fork:

python -m pip install git+https://github.com/dannyota/splunk-sdk-python@splunkctl

See the installation guide for environment-specific setup.

Quickstart

# Configure and verify Splunk Enterprise
splunkctl config init
splunkctl doctor

# Read live state
splunkctl info
splunkctl search run 'index=main | head 10'
splunkctl rules list --json

# Preview a change; add --yes only after reviewing it
splunkctl rules disable 'My Rule'

# Add and verify Splunk SOAR when needed
splunkctl config init --soar