Speaking only from my experiences with the 2.0 and 3.0 appliances, you would need to setup scp jobs to get the data off of the appliance then indexed into Splunk, then from there build your reports.
I've looked into this method for implementation with my RSA SecurID splunk app, but it involves a lot more development time than I have right now and it would depend on more end-user configuration (allow scp between the appliance and splunk host, enable ssh keys, permissions on the appliance, etc...).
