Something like this?
index=foo sourcetype=bar | stats count by ip | eval class = "reporting"
| inputlookup append=t your_file_containing_a_list_of_ips | eval class = coalesce(class, "expected")
| stats values(class) as class by ip
| search class="expected" NOT class="reporting"
