Check the join command to link results from 2 searches over a field, or if you have a database define a database lookup. join : http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join lookup to static file : http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup database lookup using dbconnect : http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Abouttheconnector Otherwise another solution is to use a subsearch to return conditions for the main search, but it is better suited for small sub sets of events than all of your ips .... see http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches ... View more