I suppose it's "by design". Your user has a defined time zone and splunk renders all times in that zone while internally representing the timestamps as epoch-based unix timestamps. I know that there are some border-cases (mostly when you're working in some multinational environment and want to have a different timezone based view on something to see how it corresponds to - for example - another country based team work schedule) but for most part it's actually a pretty sound design choice. If people suddenly started casting timestamps into various timezones, you would have no way of telling whether "10:41" means 10:41UTC or 10:41CET.
... View more