The simple approach here is to save the search to run nightly at an off hour, and then get email alerts. It won't give you a consolidated report of all the anomalies (it would send you them one-by-one).
You absolutely could push these alerts to a summary index, and then build a report off that summary index, to get to that status, but it will likely take some experimentation to get right. Summary Indexing is covered extensively in Splunk Docs, and my personal preference for using it is: http://www.davidveuve.com/tech/how-i-do-summary-indexing-in-splunk/
Apologies for the somewhat vague response, but hopefully this is helpful (if a bit tardy). This is also an area where we'd like to provide a bit more structure in Splunk Security Essentials.. but at this point it's not committed development.
