Here is a query I use to search for 4720 events and put them into a table, however I'm not sure how to extract the Message field to show last. Maybe this will give you a starting point, sorry I couldn't help further 🙂
source="WinEventLog:Security" (NewDomain="YOURDOMAIN") (EventCode="4720") NewAccount_Name!=$* |table *
... View more