So figure out how to do this (was not easy). You have to eval a test field with some unique host ID and the timestamp and then negate the transaction results based on that - putting the new test field together inside of the subsearch and outside of it before you do the subsearch:
index=windows* EventCode=1
| eval TESTFIELD=ip_address._time
| search NOT
[ search index=windows* (EventCode=1 OR EventCode=2 OR EventCode=3)
| transaction ip_address startswith=EventCode=1 endswith=(EventCode=2 OR EventCode=3) maxspan=12m
| eval TESTFIELD=ip_address._time
| fields TESTFIELD
| table TESTFIELD ]
| fillnull value=NULL
| table ip_address EventCode host _time TESTFIELD
... View more