you would need to turn on GP for that. Once you start getting audit logs for your users then you can add this stanza to all the forwarders (obviously with more details, like index)
keep in mind this will be very noisy so a hefty blacklist will be needed.
config changes can be found here
We do have GP turned on, our issue is there's no details for when a file is downloaded specifically. We can tell when a file is accessed. Does that mean with Splunk we can get what we are looking for?