This question has very little to do with Splunk or your familiarity with Splunk. As @PickleRick suggested, the first most important question is: What data source do you have in Splunk?
The real question you need to ask is: How do I, without Splunk, determine from A source that has been ingested into Splunk "email delivery status with reason, or detailed information if delivered/not delivered, as well as multiple specific subject sources from Postfix?" This is a data analytics forum, not a Postfix or a Linux forum. But there is more to a search. You need also to ask yourself: Which Email am I searching for?
Assume your Splunk instance contains syslog entries from Postfix, you can determine delivery status if the recipient is known (better, if both sender and recipients are known) as well as the approximate time of that Email. No, a typical postfix configuration does not include subject in logs. So searching for subject is futile. Also note: Modern syslog can use different log formats. Which one does your system use?
If you can post answers to these questions you ask yourself, volunteers here can help you construct a meaningful search. Or you may have found the search when trying to answer those questions.
