Is it possible to have indexers listen over multiple ports to accept data from devices outside of their environment?

[Runals]

We are experimenting with having workstations/laptops send data into Splunk. In looking at firewall drops outside of our internal address space, I had the thought of having this class of device send data in on a different port than our servers. In a quick read of the inputs.conf docs, I came away with the impression you can really only set one ssl related port. I guess it doesn't explicitly say that though.

Has anyone done something like this - either generically set multiple ports for indexers to listen for data (ssl) or tackled the challenge of accepting data from devices outside of their environment.

[esix_splunk]

You can have Splunk listening on multiple ports, as Splunk inputs. You can configure this via the inputs.conf or per the GUI.

http://docs.splunk.com/Documentation/Splunk/6.2.2/admin/inputsconf
http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Monitornetworkports