I can't see why alternate filesystems would not "work" as long as POSIX semantics (including locking) are maintained. Now, Splunk support may not support anything but NFS. But, typically, SMB/sshfs and several others are not going perform as well as NFS. Unix NFS has the advantage of years of tuning and a tight integration into the kernel. Many non-NFS networked filesystems are (on Linux) hooked in using FUSE, which introduces substantial delay itself. (I think sshfs suffers from this)
