Where “host=”your_sh_host”” you could specify a host, or put a wildcard * in place.

index="_internal" source=*access.log user!="-" */app/* (host="your_sh_host") 
| rex field=referer "/en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" 
| top 10 dashboard