The following Splunk query will list the top 5 visiting countries using the built in “iplocation” feature in Splunk:

sourcetype="iis" | iplocation c_ip |top limit=5 Country | eval percent = round(percent,2) . " %" | rename count as Views | rename percent as Percent