User events are processed to estimate a unique user count. An identifier hash, having a bucket index portion denoting one of a plurality hash buckets, is generated for each of the user events. At a processing node, each of the user events is allocated to one of a plurality of processing threads based on the bucket index portion of its identifier hash. A unique user count is estimated as follows: for each user event satisfying at least one query parameter, 1) determine a run length of a second portion of its identifier hash, 2) compare it with a value of the hash bucket denoted by the bucket index portion of that identifier hash, and 3) if the determined run length is greater, change that hash bucket value at that node to match the determined run length. The hash bucket values are used to estimate the unique user count.