As a basic example, you could populate your dropdown from this sort of query | makeresults | eval event="{\"APPL\":[{\"t\":1599753600,\"o\":12.72,\"h\":12.785,\"l\":12.72,\"c\":12.785,\"v\":524}],\"AMZN\":[{\"t\":1599753600,\"o\":13.99,\"h\":13.99,\"l\":13.99,\"c\":13.99,\"v\":200}],\"GOOG\":[{\"t\":1599753600,\"o\":33.69,\"h\":33.82,\"l\":33.69,\"c\":33.82,\"v\":3372}],\"XOM\":[{\"t\":1599753600,\"o\":37.67,\"h\":37.78,\"l\":37.66,\"c\":37.76,\"v\":10404}]}\n{\"XYZ\":[{\"t\":1599753600,\"o\":12.72,\"h\":12.785,\"l\":12.72,\"c\":12.785,\"v\":524}],\"ABC\":[{\"t\":1599753600,\"o\":13.99,\"h\":13.99,\"l\":13.99,\"c\":13.99,\"v\":200}],\"ASDF\":[{\"t\":1599753600,\"o\":33.69,\"h\":33.82,\"l\":33.69,\"c\":33.82,\"v\":3372}],\"APPL\":[{\"t\":1599753600,\"o\":37.67,\"h\":37.78,\"l\":37.66,\"c\":37.76,\"v\":10404}]}"
| eval event=split(event,"\n")
| mvexpand event
--- above generates some data in event field
| spath input=event
| head 1
| fields - _*
| foreach *.c [ eval name=split("<<MATCHSTR>>","{") | eval stock=mvappend(stock, mvindex(name,0)) | fields stock ]
... View more