Looks like you need to do the iplocation before hand, as the data doesnt yet contain the Country info until you do. This may not be the most efficient, but try this to get started, it worked for me:
index=myFirewall | iplocation clientip | lookup blacklisted.csv blacklisted_countries AS Country OUTPUT blacklisted_countries AS Country | geostats count by Country
I created a lookup called blacklisted.csv with a column called blacklisted_countries which contain the list of countries. Ensure the names are initial caps. so Spain, not spain.
Also, not sure why you were doing the stats count by src_ip first, since the geostats is doing a count by country anyway, and that stats command will be removing all the fields aside from src_ip too. So I just took it out.