First, if you have a field that contains several IPs you can split the events
- you may want to define a multivalue field (see makemv)
- and split each event in one event per IP (see mvexpand) .
see http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Parsemultivaluefields
Second, to do the matching between the results and the second list.
You can use several methods like :
- use JOIN command (only if you have less than 10000 lines in the list)
- use a lookup, and maybe add a command to mark the matching/non matching events.