Exclude a Country with geoip

[brywilk_umich]

Hello,

I have the following search
index=collaboration sourcetype="mail-2" Auth | geoip simta_client_ip | dedup simta_smtp_authuser | table simta_smtp_authuser simta_client_ip_country_name

I would like to exclude the "United States" from the countries returned. Its probably easy but I cannot seem to find a way to do it.

thanks for the help!

[kristian_kolb]

... | where field != value

in your case probably something like

where simta_client_ip_country_name != "United States"

/k

[saurabh_tek]

Thanks @kristian.kolb