In Splunk Roles can be shared within the same machine. When there are small deployments, most of the roles can be shared like Indexer, Search Head and License Master. However, if there are larger deployments, then the best practice is to host each role on a stand-alone host.

BY Best Interview Question ON 24 Feb 2020