Unfortunately, because the app relies on a search to populate TSIDX rather than raw events, it isn't a good candidate for data models. (Would that it were!)
My general recommendation would be to install it on your DMC (Distributed Management Console) server. The DMC also needs to be installed on a box outside of the cluster, and fulfills similar roles. You should be forwarding logs from your SHC members to the indexers, so you can install it wherever you want. The large beta customer for the app has something like 12 different search heads across the organization. By installing this app on one server, they can get visibility across all their search heads. A Splunk-internal installation of the app pulls in data from something like 30 or 40 search heads, at which point some of the graphs become a little silly, but overall the system works well!
Does that sound viable for your environment? There are certainly approaches you could take to deploy the app on a SHC member (without benefiting from the HA of SHC), but for most customers it makes more sense to leverage the forwarding of logs and install on an admin box.
