Since every app when invoked first can only be accessed by invoking the app ur, you can find out the apps being used by searching the index=_internal and sourcetype=splunk_web_access to find all the invocations of the app url like this:
| rex ".*\"(?<url>http(s)*\:\/\/[^\"]+)\""
| rex field=url "http(s)*\:\/\/(?<domain>[^\:]+)\:(?<port>[^\/]+)\/.*\/app\/(?<appName>[^\/]+).*"
| table appName
| dedup appName
This will take care of the app part. That said, since Splunk App for Windows Infrastructure has some knowledge objects that are shared, you will have to check them individually.