So I actually found a pretty simple solution for this.
You can enable "Event" logs from the VPN appliance to by syslogged (or Universal Forwarded) to your Splunk instance. Part of the Event logs are that every hour on the hour, it will generate a log entry for number of concurrent users and number of NCP connections. Now, I can just look for the log entry every hour and plot the concurrent users. The Pulse Secure App for Splunk automatically field extracted this information for me.
Very simple query for a line chart:
index=XXX concurrent_users="*" | table _time, concurrent_users
... View more