I do agree. There best method will be to use lookup table (if no of dest_ips are low, which I believe will not be) OR use of summary indexing. You can schedule a saved search to write into a custom summary index hourly or daily, per your requirement, list of all dest_ip with signature 2245 OR 2700. Once that is setup, in the first query subsearch,instead of searching the main index, you'll just search from summary index data which is already summarize and will be much much faster (personal experience)
http://docs.splunk.com/Documentation/Splunk/6.1/Knowledge/Configuresummaryindexes
... View more