Monitoring and Creating Alerts in Splunk - Splunk Essentials - page 174

In the map shown here, you can see that longitude and latitude data has been used to
cluster the events into the geobins listed on the left. The counts and percentages falling in-
to each of these geobins is shown, and the size of the bubbles indicate the relative counts
in each geobin.
We can also search by using the field Region, using the following code:
buttercupgames | iplocation clientip | geostats count BY
Region
The result will be as shown in the following screenshot:
Mapped Counts of Client IP Addresses by Region