I am attempting to undertake a similar effort to reduce/eliminate telephony credits.  I am finding that logs exported to splunk can identify the devices but associating the device use back to the end user is tricky at scale.  For now I use the result...