great splunk howtos

using a simple tcp logger implementation:
http://www.igvita.com/2008/06/19/splunk-your-distributed-logs-in-ec2/

using syslog-ng:
http://www.igvita.com/2008/10/22/distributed-logging-syslog-ng-splunk/