Pretty much you would have to do it like you'd protect any other application (or the OS itself) on the remote machine: set up user and file system (and other) permissions to prevent modification of the application. This may mean installing and running Splunk as a a special user.
I do note that using puppet, you can fairly easily ensure that the $SPLUNK_HOME/etc/apps (and in fact the entire etc folder) does not get modified, and that if it does, puppet brings it back into sync.
