It looks like it might not work with _time fields - try assign a new field to the formatted value e.g. | eval Time=strftime(_time,"%F %T") Then change to formatting to take this new field into acc...
See more...
It looks like it might not work with _time fields - try assign a new field to the formatted value e.g. | eval Time=strftime(_time,"%F %T") Then change to formatting to take this new field into account <colorPalette type="expression">if(tonumber(strftime(strptime(value,"%F %T"),"%H")) == 6 OR tonumber(strftime(strptime(value,"%F %T"),"%H")) == 11 OR tonumber(strftime(strptime(value,"%F %T"),"%H")) == 18 OR (tonumber(strftime(strptime(value,"%F %T"),"%H")) == 21 AND tonumber(strftime(strptime(value,"%F %T"),"%M")) < 35), "#A2CC3E", "#F58F39")</colorPalette>