@gcharles appendcols will have sub search limitation, so option 2 would definitely be better than option 1. Have you tried running the two query with bulk data and use Search Job Inspector to compare their performance?
You should however use
Option 3 using rename to format column name after timechart
Instead of replacing the values in the data you can perform timechart with actual app name and then use rename command in the end to format the column name.
index="index1" (app="outbound-service" message="Outbound Successful*") OR (app="inbound-service" message="Inbound Successful*")
| rex field=message "Amount=(?[0-9]+)"
| eval amount=amount/100
| timechart span=1d sum(amount) by app
| rename "outbound-service" as "Outbound ($)",
"inbound-service" as "Inbound ($)"
Following is a run anywhere example based on Splunk's _internal index
index=_internal sourcetype=splunkd log_level!=INFO
| timechart count by log_level
| rename "ERROR" as "Splunkd Errors", "WARN" as "Splnkd Warnings"