From Splunk docs for %X: The time in the format for the current locale. For US English the format for 9:30 AM is 9:30:00.
From Splunk docs for %c: The date and time in the current locale's format as defined by the server's operating system. For example, Mon Jul 13 09:30:00 2015 for US English on Linux.
Question -- is %X as defined by the Splunk server's operating system OR the locale of the browser viewing the page?
Since the strftime command is processed on the server, the server's locale/OS rules.