Hi @graciellamauri,
the answer is not to both your roles:
at first because you system continues to work also in case of fault of both these servers, so they aren't a Single Point of Failure.
then because for these roles Splunk doesn't permits a cluster.
You can check this position also at https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf
If you's Deplument server is overloaded, the easiest approach is to give hime more resources, e.g. instead of 12 CPUs and 12 GB RAM you could give it 24 CPUs and 24 GB RAM.
You could also use two or more DSs, but you have to create a cascade configuration so one or more DSs are client of the main DS.
it isn't a so complicated configuration but it must be done, for this reason I hinted to give more resources; in every case, it isn't a problem if it's slow, because it's role is only to check Forwarders' configurations and eventualy push the updates, not other.
Instead Master Node must be unique, you eventually could have a cold copy of it to start in case of fault, but it isn't mandatory because you system will continue to work as usual also without it, the only limit is that buckets aren't replicated.
If you see that you Master Nodei is overloaded (you can check this only using the Monitoring Console), also in this case, give it more resources.
Ciao.
Giuseppe
