With the assumption that the events in the logs that are within 2 minutes of eachother this should give you the infor you want. replace <myappname> and <mydashboard> with the appropriate app_name and dashboard_name.
index=_internal source=*/web_access.log*
| search "/app/" AND "POST"
|rex "\/\/\w+\:\d{4}\/en-US\/app\/(?<app>\w+)\/(?<view_name>\w+)"
|search app="<myappname>" AND view_name="<mydashboard>"
| transaction referer maxspan=2m
|table _time,app,view_name,user,form_email
or
index=_internal source=*/web_access.log*
| search "/app/" AND "POST"
|rex "\/\/\w+\:\d{4}\/en-US\/app\/(?<app>\w+)\/(?<view_name>\w+)"
|search app="<myappname>" AND view_name="<mydashboard>"
| transaction referer maxspan=2m |timechart count(form_email) by user
... View more
