Splunk search to check app usage on an SH

gistfile1.txt

index=_internal host=<your search head(s) here>  app=* source="/opt/splunk/var/log/splunk/splunkd_ui_access.log" OR source="/opt/splunk/var/log/splunk/web_access.log"
| rex "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s+-\s+(?<user>\d+)"
|search NOT (user="-" OR user=<your user, if you recently visited the apps>)
| stats max(_time) as last_used dc(user) as app_user_count values(user) as user by app host
| convert ctime(last_used)
| search NOT (app=search OR app=launcher)

# I filtered my own user because I was visiting every app just before running this search.