Splunk Log Analysis MCP Agent with Spring Boot and Ollama
A complete guide on building and configuring a Spring Boot AI application that acts as an MCP Server for Splunk log analysis.
This project is a Java Spring Boot MCP server that helps an AI assistant inspect logs and explain failures. In simple terms, it does this: GitHub URL - https://github.com/sonani-pankaj/java-mcp-server
- Accepts a tool request from an MCP-compatible client.
- Gets logs from either:
- a local log file, or
- a Splunk server.
- Sends those logs to a local Ollama model.
- Returns a short explanation of:
- the main error,
- where it happened,
- and the likely root cause.
The repository is written entirely in Java, built with Gradle, uses Spring Boot 3.4.1, Spring AI 1.0.0, and is configured to run as an MCP server over STDIO. The default AI model is qwen2.5:7b through Ollama. The two exposed tools are analyzeSplunkLogsTool and analyzeLocalLogFileTool.
The big idea
Think of this project as a bridge between:
- your IDE or AI client
- your logs
- a local AI model
Instead of manually reading long stack traces, you ask your AI assistant to use the server’s tools. The server fetches the logs, passes them to the model, and gives back a compact answer.
What technologies it uses
Core stack
- Java 21
- Spring Boot
- Spring AI
- Ollama
- Gradle
- Splunk REST API
- Apache Commons IO
Project structure
At a high level, the important files are:
README.md— usage instructionsbuild.gradle— dependencies and build configsrc/main/resources/application.yml— runtime configurationsrc/main/java/com/example/splunkmcp/SplunkMcpAgentApplication.java— app entry pointsrc/main/java/com/example/splunkmcp/mcp/McpToolConfiguration.java— MCP toolssrc/main/java/com/example/splunkmcp/service/SplunkService.java— Splunk accesssrc/main/java/com/example/splunkmcp/service/LocalFileReaderService.java— local file readingsrc/main/java/com/example/splunkmcp/service/LogAnalyzerAgent.java— AI log analysissrc/main/java/com/example/splunkmcp/config/SplunkProperties.java— Splunk config mappingsrc/main/java/com/example/splunkmcp/config/JacksonConfig.java— JSON config
Step-by-step: how the project works
Step 1: The application starts
The application starts from the main Spring Boot class.
This tells Spring Boot to:
- start the application,
- load configuration,
- create the services,
- and register the MCP tools.
Step 2: Configuration is loaded
The app uses application.yml for configuration.
Important values include:
- application name
- Ollama URL
- model name
- MCP server mode
- log file output
- Splunk connection settings
Why this matters
stdio: truemeans the server communicates through standard input/output, which is how many MCP clients talk to tools.- Ollama runs locally at
http://localhost:11434. - The selected model is
qwen2.5:7b. - Splunk settings are injected into Java objects using
SplunkProperties.
Step 3: Splunk settings are mapped into Java
The project maps splunk.url, splunk.token, and splunk.index into a config class.
This makes it easy for services to read configuration without manually parsing YAML.
Step 4: The MCP tools are registered
This is the heart of the project.
The MCP tool configuration defines the tool provider and the actual tool methods.
What this means
The server exposes two tools:
-
analyzeSplunkLogsTool- takes a Splunk query and time range
- fetches Splunk logs
- sends them to the AI analyzer
-
analyzeLocalLogFileTool- takes a file path
- reads the local log file
- sends it to the AI analyzer
Step 5: Splunk logs are fetched when needed
When the Splunk tool is used, the app calls Splunk’s REST API.
In plain English
- Build an HTTP client using the configured Splunk URL and token.
- Send a POST request to Splunk.
- Ask Splunk to export matching log data.
- Return the raw response text.
If something fails, the method returns a readable error string instead of crashing.
Step 6: Local log files can be read directly
If the local file tool is used, this service reads the file from disk.
Important detail
If the file is too large, the app keeps only the last 100,000 characters. That is a simple way to avoid overloading the language model context window.
Step 7: The AI model analyzes the logs
Once raw logs are available, they are passed to the AI analyzer.
What the AI is asked to do
The model is told to:
- identify the main exception,
- find the file/class/line number,
- explain the root cause briefly,
- avoid extra text.
So the project is not just “summarizing logs.” It is specifically trying to produce a root-cause-style debugging answer.
End-to-end flow
Mermaid diagram
Simple process chart
This chart is a simple visual aid showing where most of the logical work happens.
How to run this project step by step
Step 1: Install Java 21
You need JDK 21 because the Gradle build is set to Java 21.
Step 2: Install Ollama
This project depends on Ollama running locally.
Pull the model with:
ollama pull qwen2.5:7b
Also make sure Ollama is running in the background.
Step 3: Configure Splunk if you want Splunk-based analysis
Edit:
src/main/resources/application.yml
Replace the example values in the splunk section with your real values.
If you only want to analyze a local log file, this part is less important.
Step 4: Build the project
From the repository root, run:
./gradlew build -x test
The README says the generated JAR should be:
build/libs/splunk-mcp-agent-0.0.1-SNAPSHOT.jar
Step 5: Connect it as an MCP server
This project is meant to be launched by an MCP client, not by manually typing java -jar in a normal terminal window for normal use.
Example config pattern:
{
"mcpServers": {
"splunk-agent": {
"command": "java",
"args": [
"-jar",
"C:/Pan-temp/Java-MCP/build/libs/splunk-mcp-agent-0.0.1-SNAPSHOT.jar"
]
}
}
}
Step 6: Ask the AI client to use the tools
Once the MCP client is connected, you can prompt your assistant with requests like:
- analyze a local error log
- search Splunk logs for a specific exception
- identify the crash line and root cause
What each part does
SplunkMcpAgentApplication
Starts the Spring Boot app.
McpToolConfiguration
Registers MCP tools so the client can call them.
SplunkService
Fetches logs from Splunk over HTTP.
LocalFileReaderService
Reads local log files safely and truncates large files.
LogAnalyzerAgent
Sends logs to the Ollama model and formats the analysis task.
SplunkProperties
Loads Splunk settings from YAML.
JacksonConfig
Disables failure on unknown JSON properties, making JSON handling more tolerant.
Why this project is useful
This project is useful because it turns raw logs into a simpler debugging workflow.
Instead of doing all of this manually:
- open the log file,
- search for the exception,
- inspect stack traces,
- guess the root cause,
you can let the MCP-connected AI assistant do the heavy lifting.
That is especially helpful when:
- logs are long,
- stack traces are noisy,
- errors come from production tools like Splunk,
- or you want a fast first-pass diagnosis.
Strengths of the current design
1. Easy to understand
The architecture is small and clean.
2. Local AI inference
Using Ollama keeps analysis local.
3. Two input sources
It supports both:
- Splunk logs
- local files
4. Clear tool boundaries
Each MCP tool does one job.
5. Simple setup for experimentation
This makes it a good starter project for learning:
- Spring AI
- MCP servers
- tool-based AI workflows
Limitations to know about
1. Splunk integration is basic
The code comments say this is a simple implementation and not a full production-ready async job flow.
2. Large files are truncated
Only the tail end of large logs is analyzed.
3. No advanced parsing layer
The current implementation mostly sends raw log text to the model.
4. Configuration is manual
You must supply real Splunk credentials yourself.
5. README path examples are local-machine specific
Some example paths in the README use Windows paths tied to one environment.
The simplest mental model
If you want to explain this project to someone in one sentence:
It is a Java-based MCP server that lets an AI assistant fetch logs from Splunk or local files, send them to a local Ollama model, and return a short root-cause explanation.
Quick start summary
- Install Java 21
- Install and run Ollama
- Pull
qwen2.5:7b - Configure
application.yml - Build with Gradle
- Register the JAR in your MCP client
- Ask your AI assistant to analyze logs