Splunk Search

How to get a specific country,state geoip results and ignore everything else

nishan_perera
Explorer

Hi im running the following query,

host="x.x.x.x" XXXXXX | iplocation c_ip |geostats count by City

I want to get state by state for a specific country and ignore everthing else. I'm able to do this this eval Region="xx", but since i have around 10 states in the country it dosent work. It only works if only one eval is there.

what i want ot get is something like below
e.g: Country Region
CountryName region1
region2
region3
region4
region5

Any help would be much appreciated.

0 Karma
1 Solution

nishan_perera
Explorer

Got it sorted.

host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region

View solution in original post

nishan_perera
Explorer

Got it sorted.

host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...