Regarding your original question: 2 indexers => yes. 2 servers => no.
Single-site clustering would be the best approach for you, only then splunk can take over the replication part.
But not with only 2 servers. You need at least 4 instances (two peers, one master node, one search head).
Load balancing only helps for availability if server-1 goes down, but that doesn't mean your data are in sync.
You can set up an rsync job to keep warm and cold in sync (warm/cold buckets are read-only for splunk), but not hot buckets.
Well, you can limit the retention or size in hot to not loose too many data if server-1 fails.
If your hardware is performing enough you can set up different instances for different roles on the same machine using different IPs. Different ports is not enough. But this is fiddly and totally not supported.
And seriously: Why not creating the master node and search head virtual? Or the whole thing virtual?
... View more