Check this out...
The Universal Forwarder for ARM is a dedicated Splunk package for Linux and ARM based systems where data needs to be collected directly from devices such as the Raspberry Pi.
http://apps.splunk.com/app/1611/
Raspberry Pi is a trademark of the Raspberry Pi Foundation.
Would it be possible to update the package to latest Splunk Forwsrder?
It's now a year old... thanks!
I have just sent them a request to provide ARM support in future. ARM devices are becoming more and more common (now even have amazing power conscious super dense ARM servers for the data centre).
Today, Splunk is not compiled for the ARM CPU architecture. You could raise and enhancement request as suggested at http://splunk-base.splunk.com/answers/4844/how-can-i-submit-an-enhancement-request.
please do! we're gathering information and use cases for this. if you file an enhancement request, please include as many details as possible about your use case--do you want Raspbian on Raspberry Pi or Ubuntu on Calxeda, etc.
It looks like splunk has a armv6 (32 bit) UF available for download. I'd love to see armv8 for linux as well.