Postfix mail delay subsearch

[masterpipo]

I need to correlate the delays in mail handling in postfix logs to the sender address. As you know, the line in maillog that holds the delay field is different from the one that holds the from address. I need results something similar to the one below:

---

| sender address | number of mails delayed | maximum delay |

---

Since the common values in the mails is the postfix queue id, it's very difficult and can contain a lot of subsearches. I can only correlate 2 of the 3 required fields using 1 subsearch (if delay>60, pass the queue_id to the search on top. I can then get the amount of mails delayed). But correlating the 3rd field is a bit too difficult for me.

Any help is appreciated!

EDIT
I think I got it! Used transaction command to place the fields together and then it sort of worked 🙂

[masterpipo]

index="index" host="machine" | rex field=_raw "[^:]+:[^:]+:[^:]+: (?\w+):" | transaction qid keepevicted=true | stats max(delay) by field | sort desc delay | join field [search index="index" host="machine" [search index="index" host="machine" delay>60 | dedup queue_id | fields queue_id] field=* | top field | fields field count]

here's what I got. Hope this helps someone

[jonuwz]

Post some example logs.