To help you out, here is a version of the same idea with chart instead of timechart using a strftime version of _time, and I've also renamed the fields to what your data looks like to make the connecion to your data clearer (I just picked groups pipeline and queue to have some data at hand as a run-anywhere example):
index=_internal group=pipeline OR group=queue
| bucket _time span=1d | rename group as Component
| eval Day=strftime(_time, "%d.%m.%Y")
| stats count by Day Component
| streamstats window=2 current=f last(count) as previouscount by Component
| eval delta=count-previouscount
| chart avg(count) as Value avg(previouscount) avg(delta) as Difference by Day Component
| fields - avg(previous*
... View more