Splunk log analysis MCP agent cover image
AI/ML

Splunk Log Analysis MCP Agent with Spring Boot and Ollama

A complete guide on building and configuring a Spring Boot AI application that acts as an MCP Server for Splunk log analysis.

By aigrama / Pankaj Sonani
#spring-boot#ollama#mcp#splunk#ai

This project is a Java Spring Boot MCP server that helps an AI assistant inspect logs and explain failures. In simple terms, it does this: GitHub URL - https://github.com/sonani-pankaj/java-mcp-server

  1. Accepts a tool request from an MCP-compatible client.
  2. Gets logs from either:
    • a local log file, or
    • a Splunk server.
  3. Sends those logs to a local Ollama model.
  4. Returns a short explanation of:
    • the main error,
    • where it happened,
    • and the likely root cause.

The repository is written entirely in Java, built with Gradle, uses Spring Boot 3.4.1, Spring AI 1.0.0, and is configured to run as an MCP server over STDIO. The default AI model is qwen2.5:7b through Ollama. The two exposed tools are analyzeSplunkLogsTool and analyzeLocalLogFileTool.


The big idea

Think of this project as a bridge between:

  • your IDE or AI client
  • your logs
  • a local AI model

Instead of manually reading long stack traces, you ask your AI assistant to use the server’s tools. The server fetches the logs, passes them to the model, and gives back a compact answer.


What technologies it uses

Core stack

  • Java 21
  • Spring Boot
  • Spring AI
  • Ollama
  • Gradle
  • Splunk REST API
  • Apache Commons IO

Project structure

At a high level, the important files are:

  • README.md — usage instructions
  • build.gradle — dependencies and build config
  • src/main/resources/application.yml — runtime configuration
  • src/main/java/com/example/splunkmcp/SplunkMcpAgentApplication.java — app entry point
  • src/main/java/com/example/splunkmcp/mcp/McpToolConfiguration.java — MCP tools
  • src/main/java/com/example/splunkmcp/service/SplunkService.java — Splunk access
  • src/main/java/com/example/splunkmcp/service/LocalFileReaderService.java — local file reading
  • src/main/java/com/example/splunkmcp/service/LogAnalyzerAgent.java — AI log analysis
  • src/main/java/com/example/splunkmcp/config/SplunkProperties.java — Splunk config mapping
  • src/main/java/com/example/splunkmcp/config/JacksonConfig.java — JSON config

Step-by-step: how the project works

Step 1: The application starts

The application starts from the main Spring Boot class.

This tells Spring Boot to:

  • start the application,
  • load configuration,
  • create the services,
  • and register the MCP tools.

Step 2: Configuration is loaded

The app uses application.yml for configuration.

Important values include:

  • application name
  • Ollama URL
  • model name
  • MCP server mode
  • log file output
  • Splunk connection settings

Why this matters

  • stdio: true means the server communicates through standard input/output, which is how many MCP clients talk to tools.
  • Ollama runs locally at http://localhost:11434.
  • The selected model is qwen2.5:7b.
  • Splunk settings are injected into Java objects using SplunkProperties.

Step 3: Splunk settings are mapped into Java

The project maps splunk.url, splunk.token, and splunk.index into a config class.

This makes it easy for services to read configuration without manually parsing YAML.


Step 4: The MCP tools are registered

This is the heart of the project.

The MCP tool configuration defines the tool provider and the actual tool methods.

What this means

The server exposes two tools:

  1. analyzeSplunkLogsTool

    • takes a Splunk query and time range
    • fetches Splunk logs
    • sends them to the AI analyzer
  2. analyzeLocalLogFileTool

    • takes a file path
    • reads the local log file
    • sends it to the AI analyzer

Step 5: Splunk logs are fetched when needed

When the Splunk tool is used, the app calls Splunk’s REST API.

In plain English

  • Build an HTTP client using the configured Splunk URL and token.
  • Send a POST request to Splunk.
  • Ask Splunk to export matching log data.
  • Return the raw response text.

If something fails, the method returns a readable error string instead of crashing.


Step 6: Local log files can be read directly

If the local file tool is used, this service reads the file from disk.

Important detail

If the file is too large, the app keeps only the last 100,000 characters. That is a simple way to avoid overloading the language model context window.


Step 7: The AI model analyzes the logs

Once raw logs are available, they are passed to the AI analyzer.

What the AI is asked to do

The model is told to:

  1. identify the main exception,
  2. find the file/class/line number,
  3. explain the root cause briefly,
  4. avoid extra text.

So the project is not just “summarizing logs.” It is specifically trying to produce a root-cause-style debugging answer.


End-to-end flow

Mermaid diagram


Simple process chart

This chart is a simple visual aid showing where most of the logical work happens.


How to run this project step by step

Step 1: Install Java 21

You need JDK 21 because the Gradle build is set to Java 21.


Step 2: Install Ollama

This project depends on Ollama running locally.

Pull the model with:

ollama pull qwen2.5:7b

Also make sure Ollama is running in the background.


Step 3: Configure Splunk if you want Splunk-based analysis

Edit:

src/main/resources/application.yml

Replace the example values in the splunk section with your real values.

If you only want to analyze a local log file, this part is less important.


Step 4: Build the project

From the repository root, run:

./gradlew build -x test

The README says the generated JAR should be:

build/libs/splunk-mcp-agent-0.0.1-SNAPSHOT.jar


Step 5: Connect it as an MCP server

This project is meant to be launched by an MCP client, not by manually typing java -jar in a normal terminal window for normal use.

Example config pattern:

{
  "mcpServers": {
    "splunk-agent": {
      "command": "java",
      "args": [
        "-jar",
        "C:/Pan-temp/Java-MCP/build/libs/splunk-mcp-agent-0.0.1-SNAPSHOT.jar"
      ]
    }
  }
}

Step 6: Ask the AI client to use the tools

Once the MCP client is connected, you can prompt your assistant with requests like:

  • analyze a local error log
  • search Splunk logs for a specific exception
  • identify the crash line and root cause

What each part does

SplunkMcpAgentApplication

Starts the Spring Boot app.

McpToolConfiguration

Registers MCP tools so the client can call them.

SplunkService

Fetches logs from Splunk over HTTP.

LocalFileReaderService

Reads local log files safely and truncates large files.

LogAnalyzerAgent

Sends logs to the Ollama model and formats the analysis task.

SplunkProperties

Loads Splunk settings from YAML.

JacksonConfig

Disables failure on unknown JSON properties, making JSON handling more tolerant.


Why this project is useful

This project is useful because it turns raw logs into a simpler debugging workflow.

Instead of doing all of this manually:

  • open the log file,
  • search for the exception,
  • inspect stack traces,
  • guess the root cause,

you can let the MCP-connected AI assistant do the heavy lifting.

That is especially helpful when:

  • logs are long,
  • stack traces are noisy,
  • errors come from production tools like Splunk,
  • or you want a fast first-pass diagnosis.

Strengths of the current design

1. Easy to understand

The architecture is small and clean.

2. Local AI inference

Using Ollama keeps analysis local.

3. Two input sources

It supports both:

  • Splunk logs
  • local files

4. Clear tool boundaries

Each MCP tool does one job.

5. Simple setup for experimentation

This makes it a good starter project for learning:

  • Spring AI
  • MCP servers
  • tool-based AI workflows

Limitations to know about

1. Splunk integration is basic

The code comments say this is a simple implementation and not a full production-ready async job flow.

2. Large files are truncated

Only the tail end of large logs is analyzed.

3. No advanced parsing layer

The current implementation mostly sends raw log text to the model.

4. Configuration is manual

You must supply real Splunk credentials yourself.

5. README path examples are local-machine specific

Some example paths in the README use Windows paths tied to one environment.


The simplest mental model

If you want to explain this project to someone in one sentence:

It is a Java-based MCP server that lets an AI assistant fetch logs from Splunk or local files, send them to a local Ollama model, and return a short root-cause explanation.


Quick start summary

  1. Install Java 21
  2. Install and run Ollama
  3. Pull qwen2.5:7b
  4. Configure application.yml
  5. Build with Gradle
  6. Register the JAR in your MCP client
  7. Ask your AI assistant to analyze logs