Assuming you have the data in splunk, try this
base search earliest=-3d@d | timechart span=1d dc(phoneID) as "Active Users"
If you could post some sample data that would help the community help you.