https://community.splunk.com/t5/Getting-Data-In/Report-all-Logon-Activity-United-States/m-p/535512#M89810 <P>Try this</P><LI-CODE lang="markup">| tstats `summariesonly` values(Authentication.action) as action,values(Authentication.app) as app,count from datamodel=Authentication.Authentication where * (Authentication.src="*") (Authentication.dest="*") by Authentication.src_ip,Authentication.src_user,Authentication.user | `drop_dm_object_name("Authentication")` | iplocation src_ip | where Country!="United States"</LI-CODE><P>You can change your search based on requirement and identify the field name (like src_ip / dest_ip) for which you want to identify geo_location and use <EM>| iplocation &lt;field_name&gt;</EM></P><P><EM><A href="https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Iplocation" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Iplocation</A></EM></P> Tue, 12 Jan 2021 16:54:00 GMT General_Talos 2021-01-12T16:54:00Z https://community.splunk.com/t5/Getting-Data-In/Report-all-Logon-Activity-United-States/m-p/535505#M89807 <P>I'd like to pull a logon report that shows me any logon activity that is&nbsp; != to the United States.&nbsp; Any help is greatly appreciated.</P> Tue, 12 Jan 2021 16:36:52 GMT https://community.splunk.com/t5/Getting-Data-In/Report-all-Logon-Activity-United-States/m-p/535505#M89807 itsmevic 2021-01-12T16:36:52Z https://community.splunk.com/t5/Getting-Data-In/Report-all-Logon-Activity-United-States/m-p/535512#M89810 <P>Try this</P><LI-CODE lang="markup">| tstats `summariesonly` values(Authentication.action) as action,values(Authentication.app) as app,count from datamodel=Authentication.Authentication where * (Authentication.src="*") (Authentication.dest="*") by Authentication.src_ip,Authentication.src_user,Authentication.user | `drop_dm_object_name("Authentication")` | iplocation src_ip | where Country!="United States"</LI-CODE><P>You can change your search based on requirement and identify the field name (like src_ip / dest_ip) for which you want to identify geo_location and use <EM>| iplocation &lt;field_name&gt;</EM></P><P><EM><A href="https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Iplocation" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Iplocation</A></EM></P> Tue, 12 Jan 2021 16:54:00 GMT https://community.splunk.com/t5/Getting-Data-In/Report-all-Logon-Activity-United-States/m-p/535512#M89810 General_Talos 2021-01-12T16:54:00Z https://community.splunk.com/t5/Getting-Data-In/Report-all-Logon-Activity-United-States/m-p/535518#M89813 <P>Thank you!</P> Tue, 12 Jan 2021 17:04:58 GMT https://community.splunk.com/t5/Getting-Data-In/Report-all-Logon-Activity-United-States/m-p/535518#M89813 itsmevic 2021-01-12T17:04:58Z