Hi @splunktrainingu ,
Try this configuration. Please deploy it to Indexer tier to drop the events to null queue.
TRANSFORMS-DropWinEvents = drop-eventcodes
REGEX = (?m)^EventCode=(4703|4688|4689)
DEST_KEY = queue
FORMAT = nullQueue
There is other solution where a regex expression is being used to filter out some specific events like EventCode 4624, so my suggestion is for checking how the data is after splunk indexed in order to get the correct regex expression to match the piece of the data you want to drop from indexing.
If this help, please upvote.