https://community.splunk.com/t5/Splunk-Search/How-to-get-a-specific-country-state-geoip-results-and-ignore/m-p/135297#M36991 <P>Got it sorted.</P> <PRE><CODE>host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region </CODE></PRE> Thu, 27 Nov 2014 04:16:09 GMT nishan_perera 2014-11-27T04:16:09Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-specific-country-state-geoip-results-and-ignore/m-p/135296#M36990 <P>Hi im running the following query, </P> <PRE><CODE>host="x.x.x.x" XXXXXX | iplocation c_ip |geostats count by City </CODE></PRE> <P>I want to get state by state for a specific country and ignore everthing else. I'm able to do this this <STRONG>eval Region="xx"</STRONG>, but since i have around 10 states in the country it dosent work. It only works if only one eval is there.</P> <P>what i want ot get is something like below<BR /> e.g: Country Region<BR /> <EM>CountryName region1<BR /> region2<BR /> region3<BR /> region4<BR /> region5</EM></P> <P>Any help would be much appreciated.</P> Thu, 27 Nov 2014 00:43:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-specific-country-state-geoip-results-and-ignore/m-p/135296#M36990 nishan_perera 2014-11-27T00:43:19Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-specific-country-state-geoip-results-and-ignore/m-p/135297#M36991 <P>Got it sorted.</P> <PRE><CODE>host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region </CODE></PRE> Thu, 27 Nov 2014 04:16:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-specific-country-state-geoip-results-and-ignore/m-p/135297#M36991 nishan_perera 2014-11-27T04:16:09Z