Why install Cisco Networks Add-on for Splunk Enterprise to an indexer?

[andyfromoz]

In our Splunk Enterprise environment we log our Cisco IOS events to a dedicated Syslog server.

The architecture is the Syslog server is just a universal forwarder that performs input processing. Events are then sent to dedicated heavy forwarders for the domain which perform the parsing process. The heavy forwarders then send off the events to the Indexers.

Deployment of 99.9% of the add-ons we have downloaded from Splunkbase get installed to the heavy forwarder and the search heads.

My question is why the install instruction for TA-Cisco_ios say install on the Indexer and don't install on forwarders?
For this TA which confs / parameters in the conf indicate this TA needs to be installed on an indexer?
Is it because people are just sending stuff directly from a universal forwarder to an indexer without a HF in between?

I have gone through the TA thoroughly and am still struggle to find any setting that in the TA that performs any index time things
I am happy to be corrected as we all come in here to learn.

Current environment is Splunk 6.6 but would have posted same question when on 6.3 if time had permitted

[esix_splunk · Accepted solution]

There is a limits.conf config file in the TA that would need to go on the indexers, and this relates to adjusting memory limits for lookups. But other then this, your statement is correct, since there are not any real index time operations, this can go on the HF/Aggregation Tier instead of the indexers..