Approach:
Query A: CloudWatch query where FunctionName of "*"
Query B: List of selected Function names as CSV (e.g. CSV Content via Test Datasource)
Expression(s): you need to “join” results of A and B, so only selected Function names will be in the result for Alert condition.