I have a light forwarder listening on tcp:514. It forwards data to three indexers, all of whose clocks are set to UTC time.
Several Cisco WSA proxy appliances are sending logs to the light forwarder. The WSAs don't support UTC time, so they are in US/Pacific and in Ireland.
Their syslog events arrive on tcp:514. A props/transforms identifies those events and changes the sourcetype to cisco:wsa:squid. It then routes that data to the "cisco" index rather than the "syslog" index.
The events are showing up in Splunk as being eight hours behind the present time.