If you want to identify specific unique users, a table may be your best option. If you want a count of unique users, you could try a Unique Count. Here's an example using a different dataset:
If you want a unique count... using a visualization other than a chart is going to be pretty boring. Why? because you want unique. A table works best. Otherwise you have a flat set of bars across the screen and that visualization doesnt help you consume the data easy.
To create what you want. The metric section will be unique count and the field will be the user field in your data set.
You will do a bucket agg on the field that contains outlook (maybe an app field).
You can then do another filter agg, and create a filter for your field in step 2, and match the app you are looking for. ex. appfield:Outlook. for this last part, you can also apply a lucene filter at the top of the visualization to filter for Outlook instead of embedding the filter in the visualization form.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.