HI,
The master is essential to the proper running of an indexer cluster, with its role as coordinator for much of the cluster activity. However, if the master goes down, the peers and search head have default behaviors that allow them to function fairly normally, at least for a while. Nevertheless, you should treat a downed master as a serious failure.
To deal with the possibility of a downed master, you can configure a stand-by master that can take over if needed. You can go through the link below of Splunk docs for how to do this:
https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Whathappenswhenamasternodegoesdown
... View more