Splunk can only analyze the data it's given. Both scenarios are possible IF you have the Facebook access. If you don't have the Facebook access, you can't analyze the data, no matter what software you use. If you aren't a Friend, you can't see Friend-shared items. This is not a limitation of Splunk, that is basic Facebook permissions.