In a pretty fresh 9.1.1 Splunk install (only Dashboard Examples has been added), if I tried to run the search in the Accepted Solution you linked to I wasn't getting any results because the app and view fields weren't getting extracted in the Search app context in Verbose Mode. Not sure if something has changed in the field extractions on _internal since that was posted in 2019.
If I add a rex command to force the field extract, it seems to be picking up all of the hits to splunkweb to track app usage:
index=_internal sourcetype="splunk_web_access" method="GET" status="200" user!=-
| rex field=uri_path "\/app\/(?<app>[^\/]+)\/(?<view>[^\/\s]+)"
| stats count latest(_time) as ViewTime by user app view
| sort -count
| eventstats sum(count) as countByApp list(view) as view list(count) as count list(ViewTime) as ViewTime by user app
| convert timeformat="%a %m/%d/%Y %I:%M:%S %p" ctime(ViewTime)
| dedup app
| appendpipe [stats sum(count) as count by user | eval view = "Total Views"]
| sort + user -countByApp
Note: There are other things happening in splunkweb that you don't have to count - images fetches, calls to the manager endpoints, etc. You can see them here:
index=_internal sourcetype="splunk_web_access" method="GET" status="200" user!=-
| rex field=uri_path "\/app\/(?<app>[^\/]+)\/(?<view>[^\/\s]+)"
| search NOT app=*
