I apologize for being very late to the game but yes, you can. First, you'll want to set up an auditd server on your Splunk server. Then configure your client machines to use the audispd au-remote plugin to forward their audit logs to the auditd server. Splunk will pull in the local auditd logs by default, which now contain logs for all of your servers. So no Splunk configuration is necessary, except maybe a data transform to change the Host value to the real client host.
There's a very useful whitepaper for setting up the auditd server/client part here:
http://www.redhat.com/rhecm/rest-rhecm/jcr/repository/collaboration/jcr:system/jcr:versionStorage/be...
