How splunk assigns timestamp

[splunker12er]

1. I have configured a firewall device (Cisco) to send logs to my splunk indexer .
2. I receive events in the device timezone (Eg: Timezone : JST (Japan) each events have timestamp)
3. I am searching events in splunk search head (indexer,search head in UTC Timezone). say Last 15 min -- which means splunk server time last 15 min. i.e. UTC . where i will not see the device logs here.
4. Later I re-configure my cisco device to UTC timezone.
5. Now , I can search logs for the device in UTC timezone.

Does the older logs in JST time is still remains in same format (JST) OR it configures to UTC timezone ?

[grijhwani]

Splunk has no reference back to the current state of the original source of any data. All it knows about is what it already has in its possession. This is why it is important to get the data (and extraction rules) right in the indexing input/parsing phases. Once you have it, short of re-importing (and hence hitting your input allocation), you can do nothing about historic data.

[richgalloway]

Changing the configuration of the Cisco device has no effect on logs already in Splunk,