If you are just testing Splunk - either OS will be fine, just use what's convenient.
For production use - I'd go with Server 2012. Here's why:
Server 2012 typically requires fewer reboots
Server 2012 can be locked down more tightly. (As BHeffernan writes, there are more headaches there, but good security often means a little more work.)
If you're planning to use NFS at some point - that's another factor in favor of Server 2012.
One can tie Splunk to AD authentication from any Splunk-supported platform. Authentication is done via LDAP, there are no OS-level dependencies around this.
Note that the “AD app” has been replaced by the new Windows Infrastructure App. (See: https://apps.splunk.com/app/1680/) The new app combines elements of the older Windows app and the older AD app; it supports Server 2003 through Server 2012, as well as Windows 7 and 8, Vista and XP.
And keep in mind: the search head itself can be any Splunk-supported OS, including Windows, Linux, Mac, Solaris, etc.
... View more