Splunk Search

How to get a specific country,state geoip results and ignore everything else

nishan_perera
Explorer

Hi im running the following query,

host="x.x.x.x" XXXXXX | iplocation c_ip |geostats count by City

I want to get state by state for a specific country and ignore everthing else. I'm able to do this this eval Region="xx", but since i have around 10 states in the country it dosent work. It only works if only one eval is there.

what i want ot get is something like below
e.g: Country Region
CountryName region1
region2
region3
region4
region5

Any help would be much appreciated.

0 Karma
1 Solution

nishan_perera
Explorer

Got it sorted.

host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region

View solution in original post

nishan_perera
Explorer

Got it sorted.

host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...