If I'm understanding you correctly, you would like to remove all events that do not have a matching ip from the lookup? The purpose of a lookup is to enrich your data with extra information that is contained within fields in your lookup. It will not filter your events if they do not match. In order to do this you could simply append "| search oe=" to the end of your search. Then only events with the field *oe, which has come from your lookup, will be retained.