Splunk supports several ways to receive logs from a network component. The supported way to send logs from Airlock WAF to a Splunk Indexer is by using the Syslog protocol.
Please consider the documentation in Airlock App for Splunk for instructions how to configure Airlock WAF and Splunk.