In this case we are doing a lookup of all successes that are NOT rpc1918 address apce and formating the output in a table
`vpn` action="success" NOT Calling_Station_Id=10.0.0.0/8 | rename Calling_Station_Id as src_ip | stats dc(user) as Users by src_ip, user | geoip src_ip | search NOT src_ip_country_code=US | rename src_ip_country_name as Country | stats dc(user) as Users by Country| sort -Users