The Splunk Add-on for Microsoft Exchange collects mailbox, client access, and hub transport data from your Microsoft Exchange Server hosts. This add-on is comprised of five separate add-ons that can be selectively installed: Exchange-ClientAccess, Exchange-Mailbox, Exchange-HubTransport, Windows-Exchange-IIS, SMTP-Reputation. You ONLY need to install these add-ons on FORWARDERS.
You have to also install the Splunk Add-on for Microsoft Exchange Indexes to define the indexes used by Splunk Add-on for Microsoft Exchange.