If I understand correctly, you have some NULL fields after your join
If that is correct, the following should get you at least close:
<search that gets through the `join`>
| stats values(*) as * by <unique fields you know exist>
| fillnull value="-"
stats values(...) will only include fields for which there is at least one value in the previous events
stats values(...) will populate a NULL value for events that did not have the field in question – iff it existed with a value in ay event in the set
So follow it up with fillnull so you know where the fields existed (vs did not exist)
from User warren – Stack Overflow https://stackoverflow.com/questions/76165216/how-to-remove-dynamic-column/76172997#76172997
via IFTTT