how tell auditd to not log splunk entires?

in audit.rules add

-a exit,never -F path=/opt/splunkforwarder/bin/splunkd -k splunk_exclude

and auditd should no longer log every splunk action as root.