_index=security_logs _sourceCategory=fw_security ("type=\"traffic\"" AND "action=\"deny\"") | keyvalue regex "=(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})" keys "dstip" | where dstip not in ("10.*", "172.[16-31].*", "192.168.*") | lookup latitude, longitude, country_code, country_name, region, city, postal_code, area_code, metro_code from geo://default on ip = dstip | where country_name !="" AND !isNull(country_name) | count by latitude, longitude, country_code, country_name, region, city, postal_code, area_code, metro_code