If you are connecting to a SCAN address, then you don't need the complex TNSNAMES entry. The whole point of SCAN is to move the load balancing and failover complexity to the server and out of the client configuration. SCAN handles the load balancing and failover parameters can be defined a a part of each service name. Then you can simply use the JDBC-Thin driver with the SCAN hostname and the Oracle service name to connect, as described in this post.
Potentially you could also alter the connect string prototype in the db_connection_types.conf file to use a JDBC-Thick (OCI) connection, something like this:
jdbcUrlFormat = jdbc:oracle:oci:@TNSALIAS
This would allow you to use TNSNAMES, say to define a connection string with SOURCE_ROUTE, enable strong network encryption, or to use LDAP resolution instead of tnsnames.ora. I have made similar changes with other applications designed to use the Thin connection with no problem, but I have not tested such a configuration with Splunk and I'm not sure if it would work. Perhaps someone from Splunk could comment on that configuration, and whether or not is has ever been tested...
... View more