Splunk Search

How to get a count of daily active users in the last 3 days?

Engager

Hi All,

I'm new to Splunk and new to get a count of the daily active users in the last 3 days.
Users in our system are tracked by phoneID.
How would I go about doing that?

Tags (3)
0 Karma

Legend

Assuming you have the data in splunk, try this

base search earliest=-3d@d | timechart span=1d dc(phoneID) as "Active Users"
0 Karma

Builder

If you could post some sample data that would help the community help you.