Why are the empty columns dropped by table in the dashboard but not in the standalone search box?

[Min1025]

Hi all,

I have a dashboard, some fields don't have values, the empty columns are being dropped by the table in the dashboard, but when I run this query in a standalone search box, these empty columns are displaying. How can I get these empty columns returned in the dashboard as well?

For example:(This panel created with a post process)

Base search: `fieldA=<valueA> fieldB=<valueB> |fields fieldC, fieldD, fieldE, fieldF, fieldG, fieldH`

Search: `|eval field1=fieldC- fieldD |eval field2=fieldE- fieldF |eval field3=fieldG- fieldH |table field1, field2, field3`

The table in standalone search appears like:

field1 field2 field3
< value2>

The table in dashboard appears like:

 field1  field2
    <value1>   <value2>

The empty column field3 is dropped in dashboard, how can I get this column displayed in dashboard?

[niketn · Accepted solution]

@Min1025, even in your standalone search if you click on field3 (to apply sort) it will get removed. What is the reason for your to display field with null values? Can you use fillnull command or else eval with isnull() to replace NULL with some default value like 0 or N/A

Also, hopefully you have referred to best practices for post -processing and are using a transforming command in your base search

[Min1025]

@niketnilay, Thank you, the empty columns are returning when I use eval with isnull() to replace NULL with value " ".

[niketn]

@Min1025 I have converted my comment to answer. Please accept to mark this question as answered!