There is no need to have a heavy forwarder if you're simply monitoring the Bro log files. Provided you don't choose to use a heavy forwarder, then you have no need to have the technology add-on (TA) on the forwarder. Regarding the Bro source, the only thing you need on the universal forwarder is the inputs.conf file that specifies what you're ingesting. The Bro TA does need to be on the indexer because that's where the basic parsing happens, such as line-breaking and date/time extraction (note that if using a heavy forwarder, that basic parsing happens at the forwarder). The TA also needs to be on the search head for things such as search-time field extraction. All that being said, Splunk will ignore any directives that do not pertain to the level of processing it's doing as part of the data indexing pipeline. So, there is little impact if you want to put the TA at every level of you're Splunk infrastructure, forwarder, indexer, and search head.
Here are the gory details if you'd like to dig in further. http://wiki.splunk.com/Community:HowIndexingWorks
... View more