select substr(a.dat1, 66, 8) ip,
                     case when a.dat2 like '%123%' Then 'Test1' Else 
                     case when a.dat2 like '%234%' Then 'Test2' Else 
                     case when a.dat2 like '%345%' Then 'Test3' Else '' End End End ddd
                from table1 a
               where a.ltimestamp > sysdate - 1 / 60 / 24
                 and a.serno >= (select max(serno) from table1) - 5000
                 and a.dat1 like 'UT%'

for R in (select substr(a.dat1, 66, 8) ip,
                     case when a.dat2 like '%123%' Then 'Test1' Else 
                     case when a.dat2 like '%234%' Then 'Test2' Else 
                     case when a.dat2 like '%345%' Then 'Test3' Else '' End End End ddd
                from table1 a
               where a.ltimestamp > sysdate - 1 / 60 / 24
                 and a.serno >= (select max(serno) from table1) - 5000
                 and a.dat1 like 'UT%') loop    
        fCountry := geodata.GetIPCountry(geodata.ParseIPAddress(R.ip));
        data(fCountry, R.ddd) := NVL(data(fCountry, R.ddd), 0) + 1;
    End Loop;