Ok, some things need clarification. Whereas TCP or HTTP are relatively strict terms, syslog is a very loosely applied name regarding to - depending on context - many things from completely anything sent to UDP/514 to a particular RFC5424 message format.
Most probably by saying "syslog over TLS" you mean a simple tcp-tls-based input regardless of what's being sent there.
Yes, it can be done. Just use tcp-tls: input instead of tcp:. Parameters regarding encryption/authentication not specified within particular input will be pulled from defaul [SSL] stanza.
In case of simple network inputs however, it's often worth considering setting up intermediate syslog-processing layer (sc4s, rsyslog...) to keep the network-level metadata.
And yes, technicaly speaking, you could of course use the splunk's internal certificates but it's generally good idea to use your own CA in production environment.
