OK. The important thing here is _why_ you're not getting results so this is a learning experience.
Let's dig into your search (which is actually pretty close to being OK for the task).
index=my_index app=a
That's apparently your initial search, nothing to see here. Move along.
| table app action user
Now you're making a table containing just fields app, action and user.
This is a wrong approach. On two levels.
One - this is a table command which might not make much difference in a small-scale scenario, especially when everything is done on a single server but, very importantly, table is a transforming command which means that in a bigger environment, with several indexers and separate search head your search would at this point be moved from the indexer tier (when the same operation can be run in parallel by each indexer on its own part of data) to the search head. So avoid using the table command early on in your pipeline. If you want to limit processed fields, use fields command. And remember that when using fast search mode only the fields used in the search are extracted and displayed so this intermediate limiting of processed fields might be useful in more complicated searches but in this case (and we'll go back to this shortly), it doesn't make much sense.
Two - and that will be important soon - after this command you are left with just those three explicitly requested fields. While the fields command by default drags along the internal fields unless you explicitly exclude them (most importantly _time and _raw), the table command only returns the explicitly specified fields.
|eval Month=strftime(_time,"%m")
The overall idea is sound - you want to get a field called Month containing a string representation of your month. The problem is that in a previous step you removed the _time field from your data. So you don't have the timestamp anymore and you have nothing to render into this month-string.
BTW, whenever manipulating timestamps in a middle of a search, I prefer to use fieldformat instead of eval so that you still have your original timestamps and can do arithmetics on them without needing to parse them again or can sort them but that's a story for another time.
|stats count by user Month
And that would be a good thing but in the previous step you didn't get any values for Month. So Splunk cannot group by Month because there is no Month. So you're not getting any values at all.
Since you're doing the counting quite early, you could have simply omitted the table command earlier since the stats will be limited to the count value and the "by-fields" only.
And you're missing the action part - you want the actions separately, right? So you can't aggregate them for a single user. You must add the action field to the by fields.
So your search could finally look like this:
index=my_index app=a
|eval Month=strftime(_time,"%m")
|stats count by user action Month
