I have a different answer, but it makes a few assumptions:
The logfile has a field for the ipaddresses; it is named ip_addy
The IPList.csv two fields: a field named ip_addy and a field named status. The status can contain whatever you want
A lookup named ip_lookup is defined based on IPList.csv. Under that Advanced options, the default value "not found" is set.
source="logfile" | lookup ip_lookup ip_addy OUTPUT status | where status!="not found"
This requires no sub-searches and no lists of ip-addresses (except of course in the lookup file itself).
... View more