@summitsplunk iplocation should give you country detail as well, there is no need for geom (you need cluster map and not choropleth map)
From performance perspective you should do stats first followed by iplocation and then finally geostats if you want to plot data on Cluster Map. Try the following search and confirm:
<yourBaseSearch> ipaddr=* actor_user_name=*
| stats count by ipaddr actor_user_name
| iplocation clientip
| search Country!="United States"
| geostats sum(count) as count by user