You will need a Heavy Forwarder with the Splunk Add-on For OPSEC LEA: http://docs.splunk.com/Documentation/OPSEC-LEA. It really all depends on how your CheckPoint Environment is setup. The Add-On use LEA-Logger to pull the logs via a rest call in to a Heavy Forwarder were they are unpackaged, transformed and sent to an indexer.
You have to use a Heavy Forwarder so you can configure it over the GUI. Once it's configured you're good to go.
