I don't think this has really been done yet with customization or CDK.
We use the microsoft enterprise library for all logging (in the current version) so theoretically you can configure various TraceListeners. I don't see that anyone has written a trace listener to write to splunk but this is extensible by design from microsoft. I would have thought someone would have done this already in a community somewhere but I don't see it, so you'd have to either DIY or commission some .NET developer to create a library that implements this listener.
http://msdn.microsoft.com/en-us/library/ff650498.aspx
Also, in v5.1 we added some additional logging to the database using the repository layer so agents now log back to the database tables as well, you may want to look into that. We have some database utilities for purging logs and archiving, but nothing productized for general availability, if you want these tools, perhaps check with support.
