Where should I install the Splunk Add-on for Microsoft Cloud Services?

[Koko12345678]

I'm going to use Splunk on-prem with Azure, by installing Universal Forwarder on the VMs, but still going to use the Add-on for getting Azure audit logs.
Where should I install the add-on?
In addition, do I have to use Heavy forwarder (between the UF and the indexer) in this case?

Thanks

[Koko12345678]

Thank you ! so I need to install The add-on only on the search head? or also on the heavy forwarder?

[CarsonZa]

if you are sending any data to the hf from the ufs then yes install on the heavy forwarder and then you wont have to install on the indexers.

[CarsonZa · Accepted solution]

install the TA on the search head(s). its not necessary to send to a heavy forwarder but if you dont, you'll need to install on the indexers as well.

http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Install