You can also check out this paper for more information on a variety of ways to get Oracle data into Splunk. If you want to report database changes in real-time, then db-tail may not be the best option. db-tail can capture incremental changes, but it still runs like a scheduled job - at most once per minute - and runs a query on your data that will put some minimal additional load on your system. If that is close enough to real-time for you, then it is probably the easiest option.
If you need closer to real-time, then your best bet would be a PL/SQL trigger or some such that would transmit the data directly to Splunk on a TCP input. There is some risk of data being lost that way (if packets were lost on the network or if the trigger failed for some reason) but it would be as close to real-time as you could get. There is an example of how to set this up in the paper.