Good question; I'm not familiar enough w/ splunk to give a definite answer, but I would assume:
the Windows agent and the Linux agent are different binaries
the configuration is non-trivial (i.e. more than a couple operations)
there is effectively no shared configuration/operations in the plans
there is minimal shared configuration (ApiKey or AcocuntNumber)
Based on that, I would probably do two separate roles, splunk-linux and splunk-windows or something like that.
Of course, if there was mostly shared configuration, or if only a few operations were operating-system dependent (be it Linux or Windows 2003 vs 2008), then having an if/else sort of thing seems fine.
One major benefit of the roles here will be, someone looks at it from the dashboard and says "oh ok, Splunk is installed". It's already obvious that it's a Linux vs Windows server.
And to me, the ApiKey/AccountNumber/whatever seem like variables on the role (or maybe environment, if it's different in Prod and Integration).
Down the line, we'll probably have something to deal with nested roles, role dependencies, those sorts of thing. Really need to see what the data in the field looks like!