Depends on your deployment. I usually take a standalone SH with the Monitoring Console as the Search Head (if the environment is going to be bigger). Why would you want to use an indexer or something else?
Think of a big environment where only a small portion of people have CLI access and you need either to stack licenses or install a new one and can't do it in the UI because the server has no UI or should have no UI enabled (indexers, cluster masters, deployers, forwarders).
There is this in the docs: https://docs.splunk.com/Documentation/Splunk/latest/Deploy/Manageyourdeployment
Skalli
