Hey,
I just checked the docs you are likely refering too.
They just use a common Splunk TCP input, which could be configured on every Splunk instance, although you usually don't do this kind of thing on an indexer, but on a UF or HF.
Actually, the cleanest solution for this is usually have your source (in this case greylog) write it's data to a file, and then have Splunk read that file. If you ever restart that Splunk instance or it is for any other reason unavailable, you'll most likely loose the data that would be sent during that outage. With a file, Splunk will just catch up from where it stopped before a restart.
Hope that helps!
