The instance name is available in the v$instance table. I would recommend creating a view with the instance name either hard-coded or joined from v$instance as a separate column along with the audit data columns. Then have Splunk select from your view instead of the audit trail table or view.
