sourcetype="syslog" module=* means "find all syslog events that have any value in the module field"
| eval serialno=module means "in each event, assign the value of module to the serialno field". This will overwrite any existing value of serial no. I am not sure why you are doing this. My guess is that this is part of the problem.
| lookup syslookup serialno means "use the serialno field (which now contains the value of module) and match it to the serialno field in the lookup, returning the fields from the lookup table" I can't determine what fields are returned from the lookup.
| search serialno=* means "only keep events that have some value in the serialno field." Since all events at this point will have a serialno field, this can and should be eliminated.
| table module means "only display the module field."
The following search is probably wrong, but closer to what you want: