A possible way to Log User- and Page-Access in Confluence is via the Event system - using Adaptavist's Scriptrunner for Confluence.
This ways has Pros and Cons - read Access Logging in Confluence. One Pro is that the POST to Splunk in in the backend; so we dont need to open for the receiving system in the Firewall for the world.
My site is mainly external as a website, with only one internal user, myself "bnp". In that situation, the PageViewEvent is not so interesting as if this was an internal system with multiple users.
Currently, I have found no way to correlate bot/spider/monitoring hits from the real PageViews.
Also, PageViewEvents only occur when a page is rendered and this gives back HTTP Code "200 OK" to the client. See Different Loggings for different logging compares.
In this working sample, we will post to a Splunk HTTP Event Collector - after setup and getting the Splunk Key, the collector need a POST like this:
We do eliminate the "time" field, as the POST is instantly from the Confluence server.
To achive this, we have setup a Script Event Handler:
the executes this script for every PageViewEvent:
Giving us results to work on in Splunk (Where we already has created the index needed):
And we can build a dashboard: