I was able to get Splunk to work with nextcloud logs
unfortunately, since my server is behind a reverse proxy (cloudflare tunnels) logs only say that all connections are from itself so I can’t see what the external IP address is.
not sure if logging from apache would help but It should be possible to log external IP from behind a reverse proxy. As when I used Dilerun it was able to log IPs that accessed it even though it was also behind a reverse proxy.