I checked it and was able to reproduce it. Unfortunately that's expected behavior. Let me shortly explain why. To simplify matters, let's assume you haven't used any divide or moving average, since those anyway don't influence the behavior at all.
Assume, you would just have one document, that has bytes, set to 600.
If you set the interval size (above the play button) to "auto" timelion will automatically determine, what would be a good bucket size (date range per data point). If you now look at the data of the last 48h the data range it might find reasonable will be 5 minutes. Meaning your sum aggregation, will return, that 600 bytes (because we just had that one document), were transferred in those 5 minutes the document is in.
If you now switch over to show the last 12h, it might use 1m as a bucket size, meaning you will still get the very same absolute value, i.e. 600, for that 1 minute bucket, where the document was in.
So if you basically skip the
scale_interval you will see the same absolute values, since the same absolute bytes has been transferred (by that one document). If you now apply the
scale_interval(1m), timelion needs to calculate:
You are looking at the 48h chart, you have a value of 600 bytes total transferred in a 5 minute bucket, meaning it will divide 600 bytes / 5 minutes = 120 bytes/minute has been transferred in this bucket.
You are looking at the 12h chart, it will calculate 600 bytes / 1 minute = 600 bytes / minute has been transferred in this bucket.
The same of course also will occur with more than one document, but the effect will be more visible the less documents with higher peak values exists in your data. Still it actually is the correct calculation, because there was really a 120 respective 600 bytes/minute bandwidth in that time.
If you don't want this calculation to happen, you could actually specify a fixed interval size in the select above the play button. That way you would make sure, that the bucket size is always the same, and thus the calculation retrieves what you expects. Be aware, that if you chose the interval size too small, you might not be able to select a large overall time range, since it would produce too many buckets.
I hope that explanation could help a bit solving that mystery.