Integrating McAfee ePO with Splunk, do we install Splunk DB Connect on the search head or heavy forwarder?

Hi , We are integrating McAfee ePO with Splunk where we require Splunk DB Connect to be installed. Went through the docs and found that DB Connect can be installed at the Search Head or Heavy forwarder: Splunk DB Connect on a heavy forwarder to support continual data gathering or output. Splunk DB Connect on a search head for more interactive use, including lookups, Which is the best location to install the app? We also have Splunk Enterprise Security and need these logs to be integrated.