This is a year and a half old, so I don't remember exactly how I set this up. In reading the other comments, it looks like initially I made the mistake of not creating the new index on the indexers. Can you elaborate on your problem, or create a new question with the steps you've already went through so we can try to assist you? ... View more

Can you show us what the data looks like for a regular processed carton, versus a reprocessed carton? Are there any indicators other than a reused serial number? Without seeing the data, I think it may be as simple as showing only the serial numbers that appear >1 time in whatever time period you're looking for. for example: | stats count by serial | where count > 1 From here, you could table or chart whichever fields you're interested in. To answer your question about what is passed via the pipe: the results of the search before the pipe. If you're familiar with unix/linux command lines, it's the same principle. ... View more