Hi im running the following query,
host="x.x.x.x" XXXXXX | iplocation c_ip |geostats count by City
I want to get state by state for a specific country and ignore everthing else. I'm able to do this this eval Region="xx", but since i have around 10 states in the country it dosent work. It only works if only one eval is there.
what i want ot get is something like below
e.g: Country Region
CountryName region1
region2
region3
region4
region5
Any help would be much appreciated.
Got it sorted.
host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region
Got it sorted.
host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region