PoC: Splunk Enterprise + Splunk MCP Server in Docker. Splunk4Rookies (SA-S4R) sample data, multi-agent demo, Marp presenter deck. Cursor, Claude Desktop, or Goose via npx mcp-remote; secrets with 1Password or .env.

Production incident, two contexts, one answer — composes the Splunk MCP Server + SigMap MCP Server in parallel, fused by a Splunk-hosted model (gpt-oss-120b) into one grounded, scored answer. Splunk Agentic Ops Hackathon · Platform & Developer Experience.

Agentic SOC analyst for Splunk — Claude investigates via the Splunk MCP Server; a deterministic 3-layer validator verifies every finding against real data. An anti-hallucination trust layer for agentic SOC.

Autonomous Tier-1 SOC analyst for Splunk: investigates alerts over the MCP Server, reasons with Foundation-Sec, proves every step in a tamper-evident Splunk ledger, and ships detection-as-code.

Agentic LLM quality observatory on Splunk — detects, root-causes, and rolls back quality regressions