As far as I know, Splunk only collects Configuration changes Organization security events Events from devices (such as access points, cameras, switches and security appliances)
I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.
Please, if this post was useful, leave your kudos and mark it as solved.