My understanding is that your goal is to create an alert which will be triggered when application performance of fixed application is below the threshold for any site. That means, if customers from multiple sites have performance issues with selected application, DC RUM should trigger multiple alerts. Example below shows alert addressing such case.
You need to use Application and site as two monitored dimensions. Then you need to define a filter on your application (in my example it's name is TA_SAPGUI). Assuming that you are interested in in single application, and you know it's name, you don't need to use any asterisk characters or other advanced syntax elements. See details on screenshot below:
And here's screen from Alert explorer report as a confirmation that my alert really works:
Please, let me know if you have any more questions related to this topic