There may already be "an app for that", check http://splunkbase.splunk.com/ to see.
If not, then the first thing you'll want to do is come up with a series of searches that describe the conditions you're interested in. I'm not a VPN 3000 user (ASAs instead), so I really don't know what searches would be right for this situation.
Once you have the searches figured out, then you can start making saved searches out of them, which will allow you to use them in "Simple XML" dashboards. A relevant doc topic would be http://www.splunk.com/base/Documentation/latest/Developer/Step1CreateADashboard.
One thing to consider is that the VPN3000 logs may not be your "best" source of data for this type of event. For example, we get much higher fidelity data from our RADIUS server's accounting logs. Our ASA sends an "start session" accounting event followed by an "end session" accounting event to our RADIUS server, and those are much easier to deal with. If you're using RADIUS, this may be a good choice. (My opinion is that it would be worth configuring a RADIUS server just for the accounting, even if you don't use it for authentication and authorization)
