The official answer can be found here, quoted below:
zoneinfo (TZ) database
The zoneinfo database is a publicly
maintained database of time zone
values.
UNIX versions of Splunk rely on a TZ database included with the UNIX
distribution you're running on. Most
UNIX distributions store the database
in the directory: /usr/share/zoneinfo.
Solaris versions of Splunk store TZ information in this directory:
/usr/share/lib/zoneinfo.
Windows versions of Splunk ship with a copy of the TZ database.
Refer to the zoneinfo (TZ) database
for all permissible TZ values.
Unfortunately the Wikipedia page the docs link to is less than helpful as it doesn't actually list the acceptable abbreviations for each time zone. This article lists abbreviations and includes AKST... but it's still not clear if this list is one that Splunk considers valid.
Since I'm running on linux, I decided to check /usr/share/zoneinfo/America/Anchorage. But that's not helpful either... it's a binary file.
Searching the contents of $SPLUNK_HOME for some common timezone abbreviations led me to the file:
$Splunk_Home/etc/datetime.xml
... whose header comment states:
<!-- This file contains the general formulas for parsing date/time formats. -->
Starting at line 49 it contains the following list:
<define name="_zone" extract="zone">
<text><![CDATA[((?:(?:UT|UTC|GMT(?![+-])|CET|CEST|CETDST|MET|MEST|METDST|MEZ|MESZ|EET|EEST|EETDST|WET|WEST|WETDST|MSK|MSD|IST|JST|KST|HKT|AST|ADT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|CAST|CADT|EAST|EADT|WAST|WADT|Z)|(?:GMT)?[+-]\d\d?:?(?:\d\d)?)(?!\w))?]]></text>
</define>
So... I can't say for sure but it looks like this may be the list of timezones Splunk will automatically recognize??? I'll also submit feedback to the doc team asking for clarification and linking to this thread.
... View more