Splunk does not have native encryption capability. You can encrypt the filesystem underneath it using an encrypted filesystem, but this is of dubious value. For one, it negatively impacts performance - for two, any user of Splunk would be able to see the cleartext data merely by searching.
Splunk can, however, sign event data to show that it was not tampered with.
I would seriously question my auditors on this requirement. What data is there of value within the logs that needs to be protected by encryption? Remember, the purpose of encryption is to keep something secret from unauthorized parties. Are your logs really that sensitive?
Cryptographic signing for the purpose of proving tampering is very valuable for logs, and I can definitely see where this would be in scope for an auditor. This, however, is NOT encryption.
You mention logs from Cisco ASAs -- the auditors DO realize that the ASA streams these over syslog in cleartext, right? If your ASA data is so valuable that you must encrypt at rest, wouldn't it be an issue that you cannot encrypt in transport?
I would make sure that the requirement for encryption is clearly defined so as to be able to meet it. It is difficult to design an easy-to-use and also very secure cryptosystem...
