https://community.splunk.com/t5/Splunk-Enterprise-Security/Exclude-a-Region-Country/m-p/669542#M11803 <P>What have you tried so far and what do you mean by "didn't work"?</P> Thu, 23 Nov 2023 07:40:33 GMT PickleRick 2023-11-23T07:40:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Exclude-a-Region-Country/m-p/669537#M11802 <P>&nbsp;</P><P>Hello,&nbsp;</P><P>when I run the below SPL , it gave me all the region that a user have accessed from. if I want to exclude a region or country from the list, please where do I add the SPL query and what is the SPL. I have used several exclusion query but it didn't work. please help&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>| tstats count(Authentication.user) FROM datamodel=Authentication WHERE (index=* OR index=*) BY Authentication.action Authentication.src<BR />| rename Authentication.* AS *<BR />| iplocation src<BR />| where len(Country)&gt;0 AND len(City)&gt;0</P> Thu, 23 Nov 2023 07:15:33 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Exclude-a-Region-Country/m-p/669537#M11802 codeJesus 2023-11-23T07:15:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Exclude-a-Region-Country/m-p/669542#M11803 <P>What have you tried so far and what do you mean by "didn't work"?</P> Thu, 23 Nov 2023 07:40:33 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Exclude-a-Region-Country/m-p/669542#M11803 PickleRick 2023-11-23T07:40:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Exclude-a-Region-Country/m-p/670321#M11813 <P>i added the below to get what I want.</P><P>| search Country!=&lt;country name&gt;</P> Thu, 30 Nov 2023 14:25:17 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Exclude-a-Region-Country/m-p/670321#M11813 codeJesus 2023-11-30T14:25:17Z