Edit the source of your dashboard form so it is something like this:   <row> <panel> <title>Choose stocks</title> <input type="multiselect" token="stocks"> <label>Select one or more stock</label> <choice value="All">All</choice> <search> <query>host="Alpaca:Stock" sourcetype=_json | spath input=_raw | head 1 | fields - _* | foreach *.c [ eval name=split("&lt;&lt;MATCHSTR&gt;&gt;","{") | eval stock=mvappend(stock, mvindex(name,0)) | fields stock ] | mvexpand stock</query> </search> <fieldForLabel>stock</fieldForLabel> <fieldForValue>stock</fieldForValue> <delimiter>, </delimiter> <default>All</default> <change> <eval token="form.stocks">case(mvcount('form.stocks')=0,"All",mvcount('form.stocks')&gt;1 AND mvfind('form.stocks',"All")&gt;0,"All",mvcount('form.stocks')&gt;1 AND mvfind('form.stocks',"All")=0,mvfilter('form.stocks'!="All"),1==1,'form.stocks')</eval> <eval token="stocks_choice">if(mvfind('form.stocks',"All")=0,"*.c",$stocks$)</eval> </change> </input> </panel> </row> <row> <panel> <chart> <search> <query>host="Alpaca:Stock" earliest=-1d@d+510m latest=-1d@d+15h | fields $stocks_choice$ | timechart span=5m values(*{}.c) as *</query> </search>   The query in the choice section adds your stock names to the dropdown. The delimiter put ", " between each selected stock name. The fields in the dashboard query limits the columns to be only the chosen stocks. All will allow all fields through There may be other ways to filter the fields but see if this works for you ... View more

The fields as you say are listed on the left - try adding them to your transformation e.g. ... search | table * ... View more

"with condition" earliest="-8d@d" latest="@d" | bin span=1d _time | stats count by _time | stats avg(count) as average | fields average | appendcols [ search "with same condition" earliest="-12h@m" | stats count | fields count ] | eval high=1.1*average | eval alert=if(count > high, "1", "0") Set time period of search to be at least the past 8 days ... View more