Splunk will always use UTC (GMT) to index events - internally it uses Unix Time or epoch which is always UTC.
To have Splunk search in a timezone other than UTC the simplest way is to ensure your Locale is set to the timezone you want to use as your reference time. (From the menu, click your username and select preferences)
If you have already set your locale to a UTC adjusted timezone and it still shows incorrectly, you have a problem with your timestamp extraction.
If my comment helps, please give it a thumbs up!
