I have this use case were I cannot transfer the client data from country due to their policy and my whole Splunk infra reside in different geolocation.
So my question is, what are the options do I have so that I do not have to set up the whole Splunk infra for just one client?
Can heavy forwarder serve my purpose?
HF is a Splunk server for forwarding to the indexer.
I think you should use a Splunk server (ALL IN ONE) or an indexer.
It's just a distributed search.