What is the best way to send Mulesoft logs to Splunk?

[SplunkExplorer]

Hi Splunkers,

I'm searching about the best way to send Mulesoft logs and events.
Here on community I found What is the best way to integrate Mulesoft with Splunk cloud? that states, in a nutshell, to follow this approach. 

It is clear enough how to implement it; my doubt is not related so to the procedure, but to another point.
The above link show, let's say, a direct forwarding from Mulesoft to Splunk Indexer/environment. 
What about if I plan to put a HF between Mulesoft and the indexers? 
I mean: I have to follow the same procedure, simply creating the token on my HF and then, once data arrived from Mulesoft, forward them to Indexer by the usual way? Or there are some change I have to perform?

Note: I supposed, as intermediate host, a HF for the token required generation. I supposed I cannot generate one on a UF. Feel free to correct me if I'm wrong.

[richgalloway · Accepted solution]

If you insist on using an intermediate heavy forwarder (they should be avoided when possible) then the procedure is the same except the token is created on the HF rather than on the indexers.