https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-return-results-from-all-countries-but/m-p/284753#M86109 <P>I created the following search query to cross search for users who successfully log in to a website and also received an email from a<BR /> specific sender (at the bottom), and I'm trying to filter out a few states. If I remove the <CODE>| search state!=PA state!=OH state!=10</CODE> section the query runs and I see users logging in from both the US and outside the US.</P> <P>However, with the <CODE>| search state!=PA state!=OH state!=10</CODE> section in the search, my search is limited to only US based countries and countries outside the US are no longer listed in the results.</P> <P>How can I return all countries and exclude a few states? I think my query isn't taking the fact that some countries do not have a state associated with them.</P> <P>Thx</P> <PRE><CODE>index=xxx url="https://xxx.xxx.xxx NOT (x* OR x.y.* OR x.y.* OR x.y.* OR x.y.*) [search index=xxx SenderAddress="xxx@abc.com" |dedup user | fields user] | geoip "src_ip" | rename "src_ip"_latitude as "lat" | rename "src_ip"_longitude as "long" | rename "src_ip"_country_code as "country" | rename "src_ip"_region_name as "state" | table _time user country state src_ip </CODE></PRE> Mon, 19 Dec 2016 16:31:20 GMT jwalzerpitt 2016-12-19T16:31:20Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-return-results-from-all-countries-but/m-p/284753#M86109 <P>I created the following search query to cross search for users who successfully log in to a website and also received an email from a<BR /> specific sender (at the bottom), and I'm trying to filter out a few states. If I remove the <CODE>| search state!=PA state!=OH state!=10</CODE> section the query runs and I see users logging in from both the US and outside the US.</P> <P>However, with the <CODE>| search state!=PA state!=OH state!=10</CODE> section in the search, my search is limited to only US based countries and countries outside the US are no longer listed in the results.</P> <P>How can I return all countries and exclude a few states? I think my query isn't taking the fact that some countries do not have a state associated with them.</P> <P>Thx</P> <PRE><CODE>index=xxx url="https://xxx.xxx.xxx NOT (x* OR x.y.* OR x.y.* OR x.y.* OR x.y.*) [search index=xxx SenderAddress="xxx@abc.com" |dedup user | fields user] | geoip "src_ip" | rename "src_ip"_latitude as "lat" | rename "src_ip"_longitude as "long" | rename "src_ip"_country_code as "country" | rename "src_ip"_region_name as "state" | table _time user country state src_ip </CODE></PRE> Mon, 19 Dec 2016 16:31:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-return-results-from-all-countries-but/m-p/284753#M86109 jwalzerpitt 2016-12-19T16:31:20Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-return-results-from-all-countries-but/m-p/284754#M86110 <P>You could fill your null values. So before you do '| search state!=PA state!=OH state!=10', do ' | fillnull value=NULL state | '.</P> Mon, 19 Dec 2016 16:51:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-return-results-from-all-countries-but/m-p/284754#M86110 chrishartsock 2016-12-19T16:51:34Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-return-results-from-all-countries-but/m-p/284755#M86111 <P>That worked - thx for he help!</P> Mon, 19 Dec 2016 17:01:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-return-results-from-all-countries-but/m-p/284755#M86111 jwalzerpitt 2016-12-19T17:01:13Z