I'm afraid that the question miss the point, but I feel uneasy.
I think about using shared disk to Splunk manager(Indexer) to get to auto fail-over in Splunk.
I know that Splunk has the cluster configuration, but it needs 4 server(2 peers, 1 master node, 1 search heads) at minimum (Recommended configuration is 3 peers, 1 master, 1 search heads).
We cannot get such a enough environment.
Considering about the application redundancy, I got an idea of using clustering software(Cluster Pro, lifekeeper, and so on).
Did anyone try that deployment ?
Thank you for your help.
This isn't an answer to your question, so I'm placing it as a comment.
You can do clustering in Splunk with as few as four nodes: Cluster master, two indexers, search head.