If you want a unique count... using a visualization other than a chart is going to be pretty boring. Why? because you want unique. A table works best. Otherwise you have a flat set of bars across the screen and that visualization doesnt help you consume the data easy.
- To create what you want. The metric section will be unique count and the field will be the user field in your data set.
- You will do a bucket agg on the field that contains outlook (maybe an app field).
- You can then do another filter agg, and create a filter for your field in step 2, and match the app you are looking for. ex. appfield:Outlook. for this last part, you can also apply a lucene filter at the top of the visualization to filter for Outlook instead of embedding the filter in the visualization form.