We have standardized our infrastructure on UTC, but we want to generate reports in PST. Is there a way to specify a timezone transform at search time such that the events themselves don’t need to be modified? the link below would change the actual messages as they come in and I want to keep the data in splunk and my various raw syslog messages consistent.
The answer is as wrong now as it was 9 years ago. Epoch time exists independent of time zones, but your answer alters epoch time without consideration for what epoch time is. No sense continuing the nine years of confusion simply because no one noticed the mistake before.