Hi ceichhorn,
Splunk does not check if its own logs have been edited somehow.
But, you can enable file auditing in your OS and index the results of the audit on the Splunk logs like splunkd.log or audit.log . Based on that you can also setup some alerts in Splunk, so you will get notified if there was some edits on the Splunk logs.
See some examples on how to enable auditing for Linux or Windows. Linux auditing messages can get by scripted input into Splunk and Windows auditing messages will by in the Windows Security Events.
hope this helps ...
cheers, MuS
... View more