Splunk Search

How to get a specific country,state geoip results and ignore everything else

nishan_perera
Explorer

Hi im running the following query,

host="x.x.x.x" XXXXXX | iplocation c_ip |geostats count by City

I want to get state by state for a specific country and ignore everthing else. I'm able to do this this eval Region="xx", but since i have around 10 states in the country it dosent work. It only works if only one eval is there.

what i want ot get is something like below
e.g: Country Region
CountryName region1
region2
region3
region4
region5

Any help would be much appreciated.

0 Karma
1 Solution

nishan_perera
Explorer

Got it sorted.

host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region

View solution in original post

nishan_perera
Explorer

Got it sorted.

host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...