Splunk Search

How to get a specific country,state geoip results and ignore everything else

nishan_perera
Explorer

Hi im running the following query,

host="x.x.x.x" XXXXXX | iplocation c_ip |geostats count by City

I want to get state by state for a specific country and ignore everthing else. I'm able to do this this eval Region="xx", but since i have around 10 states in the country it dosent work. It only works if only one eval is there.

what i want ot get is something like below
e.g: Country Region
CountryName region1
region2
region3
region4
region5

Any help would be much appreciated.

0 Karma
1 Solution

nishan_perera
Explorer

Got it sorted.

host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region

View solution in original post

nishan_perera
Explorer

Got it sorted.

host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...