Here's a sample of how a lookup might do it for you:
index=ndx sourcetype=srctp src_ip=* dest_ip=* earliest=-24h [ | inputlookup myBadIPsList.csv | rename badIP as dest_ip ] | timechart span=1h count(src_ip) as src_ip_count by dest_ip September 04, 2020 at 03:02PM
via reddit https://www.reddit.com/r/Splunk/comments/imj9if/compare_search_results_to_a_list/g40xqv8?utm_source=ifttt