Applies to ONTAP 9 Splunk Answer ONTAP has no capability to forward CIFS audit events to a third party server, use SMB or NFS to pull the events. Additional Information Clustered Data ONTAP CIFS Audit...Applies to ONTAP 9 Splunk Answer ONTAP has no capability to forward CIFS audit events to a third party server, use SMB or NFS to pull the events. Additional Information Clustered Data ONTAP CIFS Auditing Quick Start Guide - PG 12 RFE: CIFS Auditing output to Syslog RFE: need option to produce flat file Audit Log output