I've been using Splunk for a while but only in a very basic way, by monitoring my Kiwi syslog files.
pfSense 2.2 is currently in release candidate stage and a new log format has been introduced with this version. Among other things, this avoids the multi-line syslog problems documented elsewhere in Splunk>answers.
I ended up using REGEX to parse the logs since it has different fields depending on the type of protocol (TCP, UDP, etc.) I can share with you what I did to parse the pfsense logs in my Home Monitor App for Splunk.