I've an indexer cluster with 3 nodes and a VM cluster master, I've been using cluster master for primary searching. Can an Indexer be configured to work as both indexer and search head? (which gives me two search heads searching 3 indexer cluster)
Neither of those deployments are supported. The search head, like all other nodes, must reside on its own, separate Splunk Enterprise instance.
For details, see: http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Systemrequirements#Required_Splunk_Enterpr...
Yes, but particularly in a clustered environment, I highly advise against it. You run the risk of jeapordizing handling incoming data which breaks everything for everybody.
Technically it's possible but it'll put load on the Indexer which you'll configure as SH (it has to perform roles of Indexer as well as Search Head).