Thanks,
These internal variables return “15m” “30m” not the duration between the (today) and now -2.
My issue seems to be that the “inline” script is per bucket and not the entire result thus doc[‘count_value’].value returns a value of 1 instead of the sum 24 per bucket. I found that from the result using chrome dev tools.
count_value is a value of 1 for every hour. I use this to “sum” the hours in a day or multiple days selected from the time range. example a range of “yesterday” = 24.
((_value * 0.10) / (doc['count_value'].value * 10))*100
This works well, the result is 24 for “yesterday” for each hour in the day. But the above doc[‘count_value’].value is not the total for the range but rather the value for the hour = 1.