So after spending ages (and a support call later) on installing a heavy forwarder, here the more detailed steps.
This is written up because most of the splunk documentation doesn't cover it or is flat out wrong.
This is to install a windows heavy forwarder to forward data to the splunk cloud.
1) Download splunk enterprise exe from the splunk site and install.
2) Log in and install your license (i had to contact support for this)
Settings->Licensing
3) Remove the indexer roles.
Settings->health monitoring->Settings->General Setup, click on actions, un-tick search head and un-tick indexer. Save.
4) Download the SPL package from your splunk cloud (splunk calls this an "app" but it's just a bunch of settings). It is not the regular universal forwarder exe you get from splunk (do not install the separate universal forwarder software).
https://yourcloudname.splunkcloud.com/en-US/app/splunkclouduf/setupuf
5) Run the following command on your Splunk Heavy Forwarder (or whatever path you install splunk too).
c:\program files\splunk\bin\splunk install app full_path_to_splunkclouduf.spl -auth username:password
6) Restart splunk
c:\program files\splunk\bin\splunk restart
7) Once splunk is restarted you'll need to check the correct outputs.conf is install
8) Make sure that C:\Program Files\Splunk\etc\apps\100_yourcloudname_splunkcloud\default\outsputs.conf is the same as C:\Program Files\Splunk\etc\system\local\outputs.conf
9) If the files above aren't the same, copy C:\Program Files\Splunk\etc\apps\100_yourcloudname_splunkcloud\default\outsputs.conf to C:\Program Files\Splunk\etc\system\local\outputs.conf and restart splunk.
10) Log in to your heavy forwarder and check the forwarders are now correct.
Settings->Forwarding and Receiving->Forward data
11) You can run this search on your splunk cloud to check if it's getting data from your forwarder.
index=_internal source=*metrics.log* group=tcpin_connections | stats values(version) by hostname fwdType os
... View more