Hi, just in case someone finds this old thread and want to utilize.
The "all green" picture covers technical perspective of working platform - so yeah you can combine the roles as you want, but there are "suggestions" by splunk not to do so and even one more aspect which I do not see covered anywhere - and that is updating.
There is often very specific sequence of updating instances required to follow in order to successfully update distributed environments without service interuption and that is where you can found roadblock if you combine it badly.
... View more