Why in the world didn't you say that in the beginning? If you are running ModInputs (e.g. DBConnect to pull data), then yes, you need a full instance of Splunk so an HF would make sense. It is always a bad idea to use IHF (single point of failure). I always argue against IHF but usually lose. Don't do it.
