You have one single solution left. Use stats instead of timechart
search...|eval Time=strftime(_time,"%d-%m-%Y %T")|stats count by Time
Hoping this is what you are looking for.
That happens because you lose the bucketing and the smart x-axis-labeling performed by the timechart.
The labeling is not nice to look at, but the lack of bucketing severely changes the result of your query. You can do this:
... | bucket _time | eval time = strftime(...) | chart count by time
You will still get the less-than-smart x-axis labeling. That relies on having epoch timestamps, and will automatically fall back to formatting them according to your locale.
That timestamp is formatted according to your browser's locale, as seen at the front of the Splunk URL. For example, en-US will render an AM/PM time while en-GB will render a 24h time.
Yeah but is it possible to change the time format? i tried changing the format of time as follows,
Mysearch | timechart avg(*) | rename _time as Time | convert timeformat="%H:%M" ctime(Time) AS Time
Time format is getting changed in tooltip but x-axis labels are not getting displayed.