Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Splunk Observability Alerts (BYOK) — connector documentation

  • MCP endpoint: https://byok-splunk-observability-alerts.connectorbay.com/mcp
  • REST API: POST https://byok-splunk-observability-alerts.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-splunk-observability-alerts.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Splunk Observability Alerts Splunk Observability Cloud user API access token, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-splunk-observability-alerts.connectorbay.com/health · Tool schemas: https://byok-splunk-observability-alerts.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-splunk-observability-alerts · agent@connectorbay.com

What Splunk Observability Alerts (BYOK) is for

Splunk Observability Alerts (BYOK) lets an AI assistant read your own Splunk Observability Alerts data through the Splunk Observability Alerts API with a key you supply (Splunk Observability Cloud user API access token). Read-only: 8 tools (list_detectors, get_detector, list_detector_events, list_detector_incidents, list_incidents, get_incident, list_muting_rules, get_muting_rule). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.us0.signalfx.com, api.us1.signalfx.com, api.eu0.signalfx.com, api.eu1.signalfx.com, api.eu2.signalfx.com, api.au0.signalfx.com, api.jp0.signalfx.com, api.sg0.signalfx.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Splunk Observability Alerts. Splunk Observability Alerts and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which active detectors do we have in Splunk Observability?"
  • "Show the Splunk Observability detector DET1"
  • "When did Splunk Observability detector DET1 last fire?"
  • "Which incidents did Splunk Observability detector DET1 create?"
  • "Which Splunk Observability incidents are active right now?"
  • "Show Splunk Observability incident INC1"

What it does

  • list_detectors: List detectors with name, description, status, tags, teams, origin and the SignalFlow program text (alert rule notification targets are not returned).
  • get_detector: Get one detector by id with name, description, status, tags, teams and the SignalFlow program text (no notification targets).
  • list_detector_events: List the alert events a detector produced in a time range (anomalous or ok state changes) with timestamp, label and incident id.
  • list_detector_incidents: List the incidents a detector generated: active flag, state, severity, duration and events.
  • list_incidents: List the latest incident per detector rule: active flag, anomaly state, severity, duration, linked teams and events. Active only unless includeResolved is true.
  • get_incident: Get one incident by id with state, severity, duration, linked teams and its events.
  • list_muting_rules: List alert muting rules with description, start and stop time, filters, recurrence and linked teams. Filter by state (past, future, ongoing, open, all) or text.
  • get_muting_rule: Get one alert muting rule by id with description, time window, filters and recurrence.

BYOK key

You bring your own Splunk Observability Alerts Splunk Observability Cloud user API access token (https://help.splunk.com/en/splunk-observability-cloud/administer/authentication-and-security/authentication-tokens/user-api-access-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.us0.signalfx.com, api.us1.signalfx.com, api.eu0.signalfx.com, api.eu1.signalfx.com, api.eu2.signalfx.com, api.au0.signalfx.com, api.jp0.signalfx.com, api.sg0.signalfx.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Splunk Observability Alerts API (api.us0.signalfx.com, api.us1.signalfx.com, api.eu0.signalfx.com, api.eu1.signalfx.com, api.eu2.signalfx.com, api.au0.signalfx.com, api.jp0.signalfx.com, api.sg0.signalfx.com) with a BYOK key; documentation: https://dev.splunk.com/observability/reference/api/detectors/latest. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Splunk Observability Alerts. Splunk Observability Alerts and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Splunk Observability Alerts account.

Built for: Worldwide. Languages: English.