Use the universal forwarder, which will read the gateway log and send it to Splunk:

https://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Introducingtheuniversalforwarder