Timezone and Timestamp modification at search/report time?

[paymon]

We have standardized our infrastructure on UTC, but we want to generate reports in PST. Is there a way to specify a timezone transform at search time such that the events themselves don’t need to be modified? the link below would change the actual messages as they come in and I want to keep the data in splunk and my various raw syslog messages consistent.

http://www.splunk.com/base/Documentation/4.1.3/Admin/Applytimezoneoffsetstotimestamps

[Jeremiah]

9 years later?

[landen99]

The answer is as wrong now as it was 9 years ago. Epoch time exists independent of time zones, but your answer alters epoch time without consideration for what epoch time is. No sense continuing the nine years of confusion simply because no one noticed the mistake before.

[rgustafson]

Could you handle daylight savings time dynamically?

[bschandramohan]

Am i missing something? PST = -7:00 of GMT, so this should be 7*60*60 = 25200. Why is it 28800?

[daviduslan]

Pacific Time (PT) is -7 OR -8 of GMT depending on Daylight Saving Time. From winter to spring it's -8 (PST), from spring to winter it's -7 (PDT).