These are two separate problems.
One is auditing commands in your local system (which can be done using several methods, each with their pros and cons; the typical method is auditd).
Another one is sending the data out from your box to Splunk.
If you want to use auditd, you need to create auditd rules to track spawning new processes. This is out of scope of this forum and there are many documents all around the internet how to do that depending on what data you want logged and in which situations (logging every single process creation might be an overkill).
Typically you write auditd logs to /var/log/audit/audit.log so you need to set up your rsyslog to read that file (you need to define an input with imfile type.
And to send the files to the HF you can either use simple tcp or udp output and have a corresponding input defined on your HF (but it's not a recommended way) or you can create a HEC input on your HF and send to it via an omhttp output in your rsyslog (provided you have a sufficiently new version - not all distro-shipped versions contain that input; especially older ones). If you want to be selective, you might tie a ruleset containing that HF output to that audit.log file input.
