Search query that filters results by geolocation

[ptur]

Simply put i index a logon log to one of our services. I would like to create a table that would show me results based on geolocation, i.e. in this case, all connections made from IP addresses outside of north america. Is this possible on Splunk Cloud?

Thanks!

[mgast · Accepted solution]

sourcetype=access_* status>=400 | head 20 | iplocation clientip | table clientip, status, City, Country|where Country !="United States"

Splunk has a builtin iplocation that works great.

[ptur]

thanks! looks great