Hi Micheal,
Line 15 is not possible as it does not exist in the input data. Apart from that, the required table can be obtained using the search below:
index="at0001_saas_centrify" extracted_EventType="Cloud.Saas.Application.AppLaunch" AND ( ApplicationID="6e6a5ea1-0886-4fe1-acbb-c01496ed20ff" OR ApplicationID="23af5793-e835-4d82-96f9-67c8cf51e0db" )
| join type=inner _time,normalizeduser
[ search index="at0001_saas_centrify" extracted_EventType="Cloud.Core.Login"]
| stats values(_time) as Timestamps by normalizeduser,ApplicationID
| eval ApplicationID="App".ApplicationID
| rename ApplicationID as Application
| rename normalizeduser as User
as shown above if ApplicationID is and if you want it to be AppA then use
| eval ApplicationID="App".ApplicationID
... View more