Integrate watchdog table with views

Ultimately my goal is to track IP addresses who create accounts but never log in (usually spammers). I can find the data by hand by scrolling through the access log reports, but this is tedious on a busy site. So I figured I could make a view, filter on message logs containing "new user:" and show the IP address, just like in the access log. I was surprised to find there is no field for the message itself. There's also no fields for type or severity.

Am I missing something obvious? Also open to ideas on finding these IP addresses - to my knowledge when an account is created that never actually logs in, the creator's IP is only available in the original access log itself. Most of the "hostname" data comes up blank on these entries.