We went through the above scenario, there is no such impact in Splunk processing. It will generate soft waring i.e.-SSL certificates expired on XXX server.
if we check the logs (metrics.logs or mongod.logs we can see the message).
We experienced the same results with half of our internal splunk certs expired. That is, all processes keep running, there were no TCP errors in logs, just that one log message Server certificate is now invalid. It expired on Sat xxxx. Traffic also still looks encrypted.
What this means is that expired or invalid certificates generally will not cause your deployment to fail.
You can form your own opinion if this is a good or a bad thing.
However, your question suggests that you are using the default Splunk certificates, and you should be aware that since these are common across many thousands of deployments, the private keys for these certs are widely shared, and should not be considered to provide any element of 'privacy' in your Splunk communications.
Good practice dictates that you should issue&manage your own certificates (internal or commercial) and keep them valid - meaning correct hostnames, valid CA issue chains, and within expiry.