The strftime function in Splunk is used to format timestamps into human-readable strings. When you use strftime(_time, "%H"), it converts the _time field into the hour (00 to 23) based on the user's time zone preference setting.
Splunk stores all timestamps in Coordinated Universal Time (UTC). However, when displaying time, it adjusts according to the user's time zone preference set in their profile. Therefore, using strftime will reflect the local time for the user.
Reference:Splunk Community Discussion on Time Zone Conversion