This is most likely splunk phoning home to apps.splunk.com to check for updates. You can verifiy if this is the case by looking up the destination IP:
dig +short apps.splunk.com
54.187.11.200
dig +short -x 54.187.11.200
ec2-54-187-11-200.us-west-2.compute.amazonaws.com.
You should see a correlating event in the splunkd.log, but I believe only if there is an error:
WARN HTTPClient - Connect to=apps.splunk.com:443 timed out; exceeded 10sec
ERROR ApplicationUpdater - Error checking for update, URL=/api/apps:resolve/checkforupgrade: Connect to=https://apps.splunk.com timed out; exceeded 10sec
ERROR HTTPClient - Cannot resolve IP of host=apps.splunk.com: No such host is known.
If you would like to disable this behavior, check this answer:
http://answers.splunk.com/answers/28616/how-can-automatic-update-checking-be-disabled-for-splunkbase...