How to get a specific country,state geoip results and ignore everything else

[nishan_perera]

Hi im running the following query,

host="x.x.x.x" XXXXXX | iplocation c_ip |geostats count by City

I want to get state by state for a specific country and ignore everthing else. I'm able to do this this eval Region="xx", but since i have around 10 states in the country it dosent work. It only works if only one eval is there.

what i want ot get is something like below
e.g: Country Region
CountryName region1
region2
region3
region4
region5

Any help would be much appreciated.

[nishan_perera · Accepted solution]

Got it sorted.

host="x.x.x.x"| iplocation c_ip |search Country=Country Name AND Region!=""|timechart span=1h count by Region