Hello everyone.
Want to display the output only for the time which crosses 18 months (earliest time)
Splunk will always use UTC (GMT) to index events - internally it uses Unix Time or epoch which is always UTC.
To have Splunk search in a timezone other than UTC the simplest way is to ensure your Locale is set to the timezone you want to use as your reference time. (From the menu, click your username and select preferences)
If you have already set your locale to a UTC adjusted timezone and it still shows incorrectly, you have a problem with your timestamp extraction.