New comment on reddit

I've seen:

• Amazon Linux (in Splunk classes)
• RHEL/CentOS
• Ubuntu
• SLES
• Windows (once (and for a very strange set of circumstances))

In short, it doesn't matter.

In long, go with the Linux you either already know, or the one that your organization is already standardized on (which is nearly the same thing)

If you don't know one, or your org doesn't have a standard … first: learn Linux. You. Will. Need. It.

Second, if your organization doesn't already have a Linux standard: you most likely don't want to be self-hosting Splunk – go for Splunk Cloud. Yes, you can run it on Windows – I've seen that all of once in 3+ years in the field. No, you don't want to. Unless you're in a very particular set of circumstances where you're only looking at Windows data … and even then – it's not ideal.