Splunk for LTM

If you only want to send default BIG-IP event logs to the Splunk, a Splunk-formatted Log Destination will format the logs for you.

The iRule on the linked page is a sample for when you want to send logs to Splunk for custom events, and that iRule does the formatting inline, so you can use an unformatted Log Destination.