If you are using hardware raid, then you format it as lvm-thin by default(i usually do). Then you create Splunk on top of that. But why raid5 instead of raid10, much more IOPS you get from that.
I have one question, did anybody notice a problem with PVE9 and kernel 4.4 VMs? I need to find evidence,but it seems that there is some problem with qemu-guest-agent and 4.4 kernel and pve9 where this machines locks and just gets unresponsive.