<target xsi:type="WebService"
         name="Splunk"
         url="http(s)://SPLUNKSERVER/services/collector/event"
         protocol="JsonPost"
         encoding="utf-8"
         preAuthenticate="true">
      <header name='Authorization' layout='Splunk YOURTOKEN' />
<!-- 
OR from config
<header name='Authorization' layout='Splunk ${configsetting:name=Splunk.Token}' />
-->
      <parameter name='sourcetype' layout='_json'/> 
      <parameter name="event">
        <layout xsi:type="JsonLayout">        
          <attribute name="Exception" encode="false" layout="${exception:format=@}" />       
          <attribute name="Logger" layout="${logger}" />
          <attribute name="Level" layout="${level}"/>
          <attribute name="Date" layout="${longdate}"/>
        </layout>
      </parameter>    
    </target>

<target xsi:type="Network"
         name="Splunk"
         address="tcp://<splunk-address>:<splunk-port>"
         newLine="true"
         layout="${level}|${logger}|${message}|{exception:format=tostring}">
</target>