Should be able to do it with split=field:x.
Here is some sample data I am playing with:
So if I'm understanding your desire correctly, you'd like to do something like track the queries but only count them once per unique user? So the count for query cats on the 27th would be 2, not 3, because bob's query would only be counted once.
I think you should be able to use something like this .es(interval=2h, index=search*, timefield=timestamp, split=query.keyword:3, metric=cardinality:user.keyword)
The chart on the left is missing the cardinality metric, while the chart on the right has it added. You can see that on the 27th, the cats query count is only 2.
Does this help?