The Subject line doesn't give me the IP address of the mail server in a variable so I had to put a rex to extract it, and I had to add a search to the second search and the also I add conditions because I want to see servers that weren't blocked but are now.
Thank you for your help in getting me to this answer!
| multisearch [search sourcetype="postfix_syslog" NOT error_code=554 NOQUEUE | eval Type="Blocked"]
[search sourcetype="postfix_syslog" NOT NOQUEUE Subject: NOT 127.0.0.1| rex field=_raw "Subject:(?<subject_new>.*) from \S+\[(?<ip_address>[^\]]*)"| eval Type="Allowed"]
| rex field=from "@(?<fromdomain>.*)"
| stats count(eval(Type="Blocked")) as countBlocked count(eval(Type="Allowed")) as countAllowed by fromdomain,ip_address,from
| where countBlocked>0 AND countAllowed>0
| streamstats count as counter by fromdomain,ip_address
| stats sum(countBlocked) as "Total Count-Blocked" sum(countAllowed) as "Total Count-Allowed" list(eval(if(counter<=5,from,null()))) as "Top Users" by fromdomain,ip_address
| sort -countBlocked
... View more