Rather than trying to load an ETL file, you can instead collect data directly from the ETW Provider and then forward to Splunk. The NXLog Enterprise Edition im_etw module can do this (disclaimer: I'm involved in the project) and I've been able to use that module to forward my logs to Splunk in JSON format. I'm sure there are other ETW tools, I recently came across SilkETW but have not tried it with Splunk.
