How to replace field values received from one search result in one index with second search result in other index by comparing the values?

[AdsicSplunk]

Index 1 search result:-

Provider         IP             Version         Count
Provider1       10.10.10.1      1.0             30
Provider1       10.10.10.2      1.0             40
Provider1       10.10.10.3      1.0             100
Provider2       10.10.10.2      1.0             50
Provider2       10.10.10.2      1.0             75
Provider2       10.10.10.6      1.0             81
Provider3       10.10.10.3      1.0             25
Provider3       10.10.10.3      1.0             92
Provider4       10.10.10.4      1.0             20

Index 2 search result:-

<IPDetails>
   <Element1 Name="ABC">
      <Service Version="1.0">
         <Consumer EntityCode="Ent1">
            <IP>10.10.10.1</IP>
            <IP>10.10.10.2</IP>
            <IP>10.10.10.3</IP>
         </Consumer>
         <Consumer EntityCode="Ent2">
            <IP>10.10.10.4</IP>
            <IP>10.10.10.5</IP>
         </Consumer>
      </Service>
   </Element1>
   <Element2 Name="DEF">
      <Service Version="1.0">
         <Consumer EntityCode="Ent1">
            <IP>10.10.10.1</IP>
            <IP>10.10.10.2</IP>
            <IP>10.10.10.3</IP>
         </Consumer>
         <Consumer EntityCode="Ent3">
            <IP>10.10.10.6</IP>
            <IP>10.10.10.7</IP>
            <IP>10.10.10.8</IP>
         </Consumer>
      </Service>
   </API>
</APIDetails>

Could anyone advise me on how to replace the value of all IPs in IP field with second index's Consumer EntityCode, for example, "Ent1" should be replaced with 10.10.10.1 or 10.10.10.2 or 10.10.10.3, "Ent2" should be replaced with 10.10.10.4 or 10.10.10.5, "Ent3" should be replaced with 10.10.10.6 or 7 or 8?

[valiquet]

I don't have Splunk at the moment are your requirements are not clear, but I would try to do something with multivalue fields and spath

|search 1 ... | eval ip=mvcombine delim="," ip| map search="search 2 ...
| eval IPDetails.Element2.Service.Consumer{0}.IP{}=mvindex($ip$,0), IPDetails.Element2.Service.Consumer{1}.IP{}=mvindex($ip$,5), IPDetails.Element1.Service.Consumer{0}.IP{}=mvindex($ip$,8)"

[AdsicSplunk]

Thanks @valiquet but I got my query resolved by creating and using csv lookup.