Loading ToolBench
Model Context Protocol server for bidirectional translation between KQL (Kusto Query Language) and SPL (Splunk Processing Language)
Server provides 7 tools with complete input schemas and descriptions. Naming follows verb_noun convention (translate, explain, set, get, generate). Descriptions are present and contextual (avg ~120 chars), meeting baseline minimums. However, output schemas are not documented, LLMs cannot predict response structure for downstream chaining. Parameter descriptions are adequate but lack format/constraint details (e.g., no guidance on query syntax, confidence score range, or validation result structure). Error handling is minimal, no recovery guidance or categorization. Security is reasonable (no secrets in params), but composition could be tighter: translate, translate_kql_to_spl, and translate_spl_to_kql overlap significantly, forcing LLMs to reason about which to call.
Explain what a KQL or SPL query does in plain English. Breaks down each operation and describes the query logic.
Generate Splunk discovery queries to help find where a KQL table's data lives in your Splunk environment. Useful for Azure Event Hub ingestion scenarios.
Get the current KQL table to Splunk index/sourcetype mappings being used by the translator.
Set or update custom KQL table to Splunk index/sourcetype mappings. Use this to configure environment-specific mappings.
Translate a query between KQL and SPL. Supports both directions: KQL→SPL and SPL→KQL. Returns the translated query with confidence score and validation results.
Translate a KQL query to SPL. Uses custom table-to-index mappings if configured. Returns translated query with validation and confidence score.
Output schemas not documented. LLMs cannot predict response structure (confidence score range, validation result fields, error format). Breaks downstream tool chaining and forces agents to guess field names.
Three overlapping translation tools (translate, translate_kql_to_spl, translate_spl_to_kql) create ambiguity. LLMs must reason about which to call. Generic 'translate' with from/to enums is clearer; specialized variants add confusion without clear differentiation.
Parameter descriptions lack format/constraint details. 'query' param has no guidance on syntax, length limits, or valid operators. 'mapping' param in set_table_mapping lacks schema for nested object structure (index, sourcetype, note fields).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |
Translate an SPL query to KQL. Converts Splunk search syntax to Kusto Query Language.
No error handling guidance. Responses do not indicate whether errors are retryable, user-fixable, or fatal. Invalid query syntax returns no recovery hint (e.g., 'Try simplifying the query' or 'Check operator spelling').
get_table_mapping has empty inputSchema properties object. While technically valid (no required params), this is unusual and suggests incomplete schema definition. Should document what the response contains.