https://community.splunk.com/t5/Splunk-Search/Exclude-a-Country-with-geoip/m-p/118909#M31834 <P>Hello,</P> <P>I have the following search<BR /> index=collaboration sourcetype="mail-2" Auth | geoip simta_client_ip | dedup simta_smtp_authuser | table simta_smtp_authuser simta_client_ip_country_name</P> <P>I would like to exclude the "United States" from the countries returned. Its probably easy but I cannot seem to find a way to do it.</P> <P>thanks for the help!</P> Mon, 28 Sep 2020 15:06:54 GMT brywilk_umich 2020-09-28T15:06:54Z https://community.splunk.com/t5/Splunk-Search/Exclude-a-Country-with-geoip/m-p/118909#M31834 <P>Hello,</P> <P>I have the following search<BR /> index=collaboration sourcetype="mail-2" Auth | geoip simta_client_ip | dedup simta_smtp_authuser | table simta_smtp_authuser simta_client_ip_country_name</P> <P>I would like to exclude the "United States" from the countries returned. Its probably easy but I cannot seem to find a way to do it.</P> <P>thanks for the help!</P> Mon, 28 Sep 2020 15:06:54 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-a-Country-with-geoip/m-p/118909#M31834 brywilk_umich 2020-09-28T15:06:54Z https://community.splunk.com/t5/Splunk-Search/Exclude-a-Country-with-geoip/m-p/118910#M31835 <P><CODE>... | where field != value</CODE></P> <P>in your case probably something like</P> <P><CODE>where simta_client_ip_country_name != "United States"</CODE></P> <P>/k</P> Tue, 29 Oct 2013 00:13:44 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-a-Country-with-geoip/m-p/118910#M31835 kristian_kolb 2013-10-29T00:13:44Z https://community.splunk.com/t5/Splunk-Search/Exclude-a-Country-with-geoip/m-p/118911#M31836 <P>Thanks @kristian.kolb</P> Sun, 16 Oct 2016 08:02:02 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-a-Country-with-geoip/m-p/118911#M31836 saurabh_tek 2016-10-16T08:02:02Z