I'm new to Splunk and new to get a count of the daily active users in the last 3 days.
Users in our system are tracked by phoneID.
How would I go about doing that?
Assuming you have the data in splunk, try this
base search earliest=-3d@d | timechart span=1d dc(phoneID) as "Active Users"
If you could post some sample data that would help the community help you.