The master node must be a separate Splunk Enterprise instance from any of the peer nodes. It cannot also function as a peer node. For that reason, you probably would not find it useful to convert your current indexer to a master node. In addition, you need a separate instance to serve as the search head. Before proceeding, read, at a minimum, these two sections concerning Splunk Enterprise requirements for an indexer cluster: https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Systemrequirements#Summary_of_key_requirements https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Systemrequirements#Required_Splunk_Enterprise_instances There's also a topic, which seems relevant to your situation, on how to stand up an indexer cluster for the use case where the concern is just scaling the indexing capability rather than also maintaining high availability: https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Clustersinscaledoutdeployments ... View more

Yes. Like most indexing-related settings, you can configure SmartStore on a per-index basis. A combination of SmartStore and non-SmartStore indexes on a single cluster is sometimes referred to as a "mixed mode" cluster. See https://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/ChooseSmartStorestoragelocation ... View more