OK. There is one thing you need to know about time manipulation in Splunk.
Splunk internally processes time as so called "unix timestamp" which means that it's just a number of seconds since Jan 1st 1970 0:00:00 UTC. So I'm writing this at a point in time which has 1682409489 timestamp.
If Splunk renders this time into a string value (either automatically as it does for the _time field or when you explicitly call the strftime()) function - it always uses the timezone defined for your user in preferences. And there is no way around it.
The soultion to which @SanjayReddy pointed you to is the only way to "cheat" Splunk - it effectively changes the timestamp to be rendered (so that you don't just render your given timestamp in another timezone but rather shift the whole timestamp by the timezone-specified offset), renders that timestamp in your local timezone (as I said - there is no way around it) and just doesn't show the timezone information (and optionally "glues" the fake "destination timezone" code). It is a very ugly hack and generally you should never do that and there is a very good rationale for keeping to one timezone - it prevents the confusion among your users.
So long story short - question is whether IST is your local timezone and you just want to parse the timestamp from logs from other timezone (that's relatively easy) or is CEST your local timezone and for some reason you want to render your timestamps in IST timezone (which is usually a bad idea).
