I am using the Solarwinds Add-on. I have it installed on my HF and it is working fine. However there is one sourcetype (out of the 3) which the timestamp is not correct - it is named "solarwinds:alerts". It appears to be one hour behind the other sourcetypes. It looks to be GMT when it should be GMT+1.
I have created a new props.conf file in /etc/splunk/apps/Splunk_TA_Solarwinds/local/ directory of the HF instance . In this file I have added:
[sourcetype::"solarwinds:alerts"] TZ = GMT+1
I saved the config, restarted the HF and search for the events of this sourcetype but they still appear to be off by one hour and the TZ setting doesnt seem to be working.
Researching online, this seems to be the standard way to set a timezone. Is there something I am doing wrong?