How to get a count of daily active users in the last 3 days?

[rob9mcneil9]

Hi All,

I'm new to Splunk and new to get a count of the daily active users in the last 3 days.
Users in our system are tracked by phoneID.
How would I go about doing that?

[sundareshr]

Assuming you have the data in splunk, try this

base search earliest=-3d@d | timechart span=1d dc(phoneID) as "Active Users"

[JDukeSplunk]

If you could post some sample data that would help the community help you.