Splunk Support for Active Directory: Is there a way to exclude a particular OU from a search?

Is there a way i can exclude a particular OU from a search when searching for Active Directory logs? The idea would be to set up an alert to tell me when someone chooses the 'Don't Expire Password' flag on an AD account but to exclude accounts created in a specific OU? E.g. accounts created in the "service accounts" OU.