I usually try to avoid to use transaction command all the times I can, so, please, try something like this:
index=ph_windows_sec sourcetype=XmlWinEventLog (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) earliest=-14d
| eval status=case(EventCode=630, "Deletion", EventCode=4726, "Deletion", EventCode=624, "Creation", EventCode=4720, "Creation")
| stats dc(status) AS dc_status earliest(_time) AS earliest latest(_time) AS latest BY user
| eval duration=latest-earliest
| where duration<3600 AND dc_status=2
Anyway, probably there's and error in your search because you want to use in transaction command the field "user" and in eval command the field "EventCode", but you haven't this fields in the stats command, so they aren't available for the following commands.