The easiest solution that I have used in the past (while retaining as much security as possible) would be to reconfigure the syslog daemon on the system to also output log data to itself over the network. If using syslog-ng, you can do all sorts of filtering and pre-formatting to make it friendly to splunk while retaining the same format on the filesystem (EG, putting it into much easier to read key-value pairs rather than space-deliminated fields, quoting the message field, etc).
Syslog would be configured to send to 127.0.0.1:; Splunk would then be configured with an input configured to listen on that same high-numbered port. The traffic goes over the loop-back interface, so never goes outside of the box until Splunk forwards it; the /var/log filesystem remains untouched; and the events coming into Splunk can be massaged to be much friendlier to indexing / extracting.
... View more