One method could be top partition the set of files on the different Splunk instances to read and forward.   We can divide logs based let say part1 and part 2 and whitelist part 1 on one set of node: /var/log/[a-m]* and another part on other set of node  /var/log/[n-z]*.