Yes, unfortunately this is the way it works - I have never fully worked out why this is the case - but most of the time it doesn't really matter as - I have used techniques to solve this where I needed to only get the fields that pertained to the particular event, but that involved quite a bit of other work You can do something simple like search bla | transpose 0 | where isnotnull('row 1') | transpose 0 header_field=column | fields - column If this is just about data investigation and looking for things. Give us more on any use case where this is an issue and we can see if there is a way to solve it.   ... View more