It would be great if you could provide an example,
if you want the value VARIATION during the day, maybe you want the first and last of each day and calculate a variation. this would be
xxx |bucket _time span=1d|stats first(version) as first, last(version) as last by _time, endpoint|eval variation=last-first
OR do a simple delta between the last value of each day :
xx|bucket _time span=1d|stats last(version) as last by _time, endpoint|delta last as variation
Also for variation, streamstats could be your friend. And lastly : check delta blogpost
Does it help ?
... View more