Key is to monitor evtx files using the special preprocess-event sourcetype on a windows instance of Splunk.
1. Copy evtx to spare windows server
2. Load as many services as possible for known content (IE if evtx for AD load AD etc)
3. Install Splunk
4. Monitor directory with evtx files
I did this on a Windows EC2 instance successfully, stopped Splunk on Windows EC2 instance and then copied the following over to my test instance of Splunk on my Mac to faster / more direct access to the parsed evtx: