Fair point about the order. Hadn't picked up on that constraint. Can't find a way to preserve the order when running a search in the search editor, but have a solution for a dashboard context by virtue of using a token to preserve the desired order. Arguably, this shouldn't work, as we're effectively 're-creating' the lost columns by running the tokenized fields command (try opening the second panel's search in the search editor to see what I mean)... but for some reason this works in the context of the dashboard. For anyone who doesn't have access to _internal index, substitute your own search and modify the relevant commands in the base search to make the following work <dashboard> <label>remove_null_cols_and_keep_column_order</label> <search id="baseSearch"> <query> index=_internal sourcetype=scheduler earliest=-1m | table _time host user concurrency_category status scheduled_time run_time result_count | eval user = NULL | eval scheduled_time = NULL | eval _flds = "| fields _time host user concurrency_category status scheduled_time run_time result_count" </query> <done> <condition match="$job.resultCount$!=0"> <set token="displayFieldsInOrder_tok">$result._flds$</set> </condition> </done> <sampleRatio>1</sampleRatio> </search> <row> <panel> <title>Original table of results showing all columns including 'user' and 'scheduled_time' which are set to all NULL values</title> <table> <search base="baseSearch"></search> <option name="count">5</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">false</option> </table> </panel> </row> <row> <panel> <title>Results after removing NULL cols</title> <table> <search base="baseSearch"> <query> <![CDATA[ | rename * AS X_*_NEW | foreach X_*_NEW [ eval <<MATCHSTR>>=<<FIELD>> ] $displayFieldsInOrder_tok$ ]]> </query> </search> <option name="count">5</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">false</option> </table> </panel> </row> </dashboard> ... View more

There's a simple way to remove columns with all null values using foreach: if you have cols a, b and c and c has all NULL values: | makeresults | eval a=10 | eval b=20 | eval c=30 | append [ | makeresults | eval a=100 | eval b=200 | eval c=300 ] | append [ | makeresults | eval a=1000 | eval b=2000 | eval c=3000 ] | table a b c | eval c=NULL | rename * AS X_*_NEW | foreach X_*_NEW [ eval <<MATCHSTR>>=<<FIELD>> ] | fields - X* will leave cols a and b, as during the eval Splunk removes any col which is all NULL values. ... View more