How to build Splunk dashboards in Metabase

Splunk is a platform for searching, monitoring, and analyzing machine data — logs, events, and metrics — at enterprise scale. Metabase is where you turn those operational signals into shared, trustworthy dashboards. This guide covers two complementary paths: a lightweight MCP + CLI route that pulls live data with the Splunk MCP Server and loads a CSV into Metabase with the Metabase CLI, and a durable pipeline route that syncs Splunk rollups into a database so you can build dashboards anyone can read.

How do you connect Splunk to Metabase?

Most teams combine both routes: use MCP and CLI uploads for a fast first pass, then move recurring reliability reporting to a warehouse-backed model.

What can you analyze from Splunk data in Metabase?

• Log volume by index and sourcetype — built from search result rollups and the related indexes, saved searches and alerts, notable events data your sync exposes.
• Error and exception trends — built from search result rollups and the related indexes, saved searches and alerts, notable events data your sync exposes.
• Alert volume and noisy searches — built from search result rollups and the related indexes, saved searches and alerts, notable events data your sync exposes.
• Ingest and license usage — built from search result rollups and the related indexes, saved searches and alerts, notable events data your sync exposes.
• Search performance — built from search result rollups and the related indexes, saved searches and alerts, notable events data your sync exposes.

Which Splunk dashboards should you build in Metabase?

How do you use the Splunk MCP Server with the Metabase CLI?

Pair the Splunk MCP Server with the Metabase CLI for fast, hands-on analysis. MCP is useful for scoped lookups and summarized exports; the Metabase CLI's upload command loads CSV data into Metabase and creates a ready-to-query table and model.

Example workflow

• Ask the MCP server for a summarized slice of search result rollups for the services you care about.
• Export the result as CSV, keeping stable IDs, services, environments, severities, and timestamps.
• Run mb upload csv to load it into Metabase as a table and model, then build questions and dashboards on top.

Be honest about the limits

• MCP lookups are excellent for exploration, not scheduled reporting.
• A CSV upload is a snapshot; refresh it with mb upload replace or move to the pipeline for real history.
• Periodic rollups (hourly or daily) are required for availability and error-rate trends.
• mb upload csv needs an uploads database configured under Admin → Settings → Uploads.

How do you set up Splunk MCP and the Metabase CLI?

{
  "mcpServers": {
    "splunk": {
      "url": "https://your-splunk.example.com:8089/services/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_SPLUNK_TOKEN"
      }
    }
  }
}

Splunk doesn't host a shared MCP URL — install Splunkbase app 7931 on your Splunk Enterprise or Splunk Cloud instance first, then point clients at the management port. The app is in Beta (Splunk Supported).

# Install the Metabase CLI
npm install -g @metabase/cli

# Log in (opens your browser; requires Metabase v62+)
mb auth login --url https://your-metabase.example.com

# Load a search-result-rollups export — creates a table AND a model
mb upload csv --file splunk-search-result-rollups.csv --collection root

# Refresh that same table later from a new export
mb upload replace <table-id> --file splunk-search-result-rollups.csv

Can you generate a Splunk dashboard with AI?

Yes. Use the prompt below with any assistant that can run the Splunk MCP Server and the Metabase CLI. It works end to end: if Splunk tables already exist in Metabase it analyzes those; otherwise it pulls scoped, summarized data over MCP, loads it with mb upload csv, then builds the dashboard and caveats any metric that needs missing history.

Create a polished Metabase dashboard for Splunk observability analytics.
Work end to end: get the data into Metabase if it isn't there yet, then build.

Goal: Help engineering and operations leaders understand service availability, error rates, alert quality, and SLO compliance from Splunk data.

Step 1 — Find or load the data:
- First, check what already exists in Metabase (search for splunk tables and
  models). If durable Splunk data is already present — synced from a warehouse
  or uploaded earlier — use it and skip to Step 2.
- If nothing is there, pull a scoped, summarized export with the Splunk MCP Server:
  search result rollups, plus indexes, saved searches and alerts, notable events.
  Prefer aggregated or rollup views over raw events. Write each result to a CSV,
  then load it with the Metabase CLI — run "mb upload csv --file <export>.csv" so
  each upload creates a table and a ready-to-query model. Use "mb upload replace
  <table-id> --file <export>.csv" to refresh an existing table instead of creating
  duplicates.

Step 2 — Inspect before querying:
Do not assume exact table or column names. Inspect available fields, services,
environments, timestamps, and whether rollups or history exist before creating
duration or trend cards.

Important:
- Build on whatever data is present; don't claim Metabase connects natively to
  Splunk — it reads a database or CLI-uploaded tables.
- Never try to load the raw event firehose into Metabase; use rollups, entity
  tables, and incident- or group-grain data.
- Only compute durations (MTTA, MTTR, time-to-resolve) when the required
  timestamps exist.
- Exclude test, staging, or muted objects from headline reliability cards, and
  segment by environment where the field exists.
- A single CSV is a point-in-time snapshot: only build trend cards if there is a
  usable date column or multiple periods have been uploaded.

Dashboard title: Splunk Observability Overview

Sections:
1. Executive summary: Availability last 30 days; Error rate; Alerts fired;
   SLO compliance; Services below target.
2. Service health: Availability and error rate by service by week.
3. Alerts: Alert volume by monitor; conversion to incidents; noisy monitors.
4. SLOs: Error budget remaining; burn rate; breaches by service.
5. Trends: Latency percentiles and traffic by service where synced.

Filters: Date range, Service, Environment, Severity, Team, Status.

Output: Build the dashboard if you have permission; otherwise provide the exact
questions, SQL, model definitions, and layout. Include caveats for any metric
that cannot be calculated from the available data.

How do you sync Splunk data into a database or warehouse?

For dashboards that need history and reliability, land Splunk rollups and metadata in a database first, then connect Metabase to that database.

Connector options

• Managed ETL — use a connector when one covers the objects you need.
• Custom pipeline — use the Splunk REST API (search/jobs/export) for control over rollup grain, fields, and refresh cadence.
• MCP + CSV — use this for quick exploration and one-off slices.

Sync summaries with Fivetran's Splunk connector, or script the REST API's search/jobs/export endpoint (output_mode=csv) to export scheduled search results — export aggregated searches, not raw events.

Notes

• Decide the rollup grain first (hourly or daily per service/environment) — it drives warehouse cost and every trend card.
• Land raw entity tables first, then build clean Metabase models on top.
• Normalize service, environment, metric, window-start, and aggregation fields.

How should you model Splunk data in Metabase?

Core tables

Modeling advice

• Build a clean service_health_rollups model with common columns across tools, so multi-source dashboards don't fork definitions.
• Separate entity tables (services, monitors, policies) from time-series rollups and event-grain tables.
• Exclude test, staging, and muted objects from headline reliability metrics; keep environment as an explicit column.
• Use stable IDs for service, team, and incident joins; display names change.

Which Splunk metrics should you track in Metabase?

What SQL powers Splunk dashboards in Metabase?

These assume a cleaned analytical model in a warehouse (PostgreSQL dialect). Adjust table and column names to match your pipeline.

SELECT
  service_name,
  date_trunc('week', window_start) AS week,
  ROUND(
    100.0 * SUM(successful_requests) / NULLIF(SUM(total_requests), 0), 3
  ) AS availability_pct
FROM service_health_rollups
WHERE environment = 'production'
GROUP BY 1, 2
ORDER BY 1, 2;

SELECT
  monitor_name,
  COUNT(*) AS alerts_fired,
  COUNT(*) FILTER (WHERE became_incident) AS incidents,
  ROUND(
    100.0 * COUNT(*) FILTER (WHERE became_incident)
    / NULLIF(COUNT(*), 0), 1
  ) AS conversion_rate
FROM alerts
WHERE fired_at >= CURRENT_DATE - INTERVAL '30 days'
GROUP BY monitor_name
ORDER BY alerts_fired DESC
LIMIT 20;

SELECT
  service_name,
  slo_target,
  ROUND(
    100.0 * SUM(successful_requests) / NULLIF(SUM(total_requests), 0), 3
  ) AS actual,
  ROUND(
    100.0 * SUM(successful_requests) / NULLIF(SUM(total_requests), 0), 3
  ) - slo_target AS margin
FROM service_health_rollups
WHERE window_start >= CURRENT_DATE - INTERVAL '28 days'
GROUP BY service_name, slo_target
ORDER BY margin ASC;

What are common mistakes when analyzing Splunk in Metabase?

Related

Related analytics

Related dashboards

Related integrations

FAQ