If you only keep the events for 1 day the alternative could be to place the information in some custom attributes, like CreatedBy and CreatedOn.
To compare the VMs from yesterday with the ones of today, you would also need to keep that information from yesterday somewhere.
I think some custom attributes would be the best solution