/**
 * Splunk SIEM Connector
 *
 * HTTP Event Collector (HEC) integration for Splunk:
 * - Batch event sending
 * - Index and sourcetype configuration
 * - Token-based authentication
 * - Retry with exponential backoff
 *
 * @packageDocumentation
 * @module security/siem/splunk
 */
import { BaseSIEMConnector } from './connector.js';
import type { SecurityEvent, SendResult, SplunkConnectorConfig } from './types.js';
/**
 * Splunk connector using HTTP Event Collector (HEC)
 *
 * Features:
 * - Batch event sending for efficiency
 * - Configurable index, sourcetype, source
 * - Token-based authentication
 * - Retry with exponential backoff
 */
export declare class SplunkConnector extends BaseSIEMConnector {
    readonly type = "splunk";
    private readonly hecUrl;
    private readonly token;
    private readonly index?;
    private readonly sourcetype?;
    private readonly source?;
    private readonly host?;
    private readonly verifySsl;
    private readonly defaultFields?;
    constructor(config: SplunkConnectorConfig);
    /**
     * Connect to Splunk (verify HEC endpoint is accessible)
     */
    protected doConnect(): Promise<void>;
    /**
     * Disconnect from Splunk (no-op for HTTP-based connection)
     */
    protected doDisconnect(): Promise<void>;
    /**
     * Send events to Splunk via HEC
     */
    protected doSend(events: SecurityEvent[]): Promise<SendResult>;
    /**
     * Send a single batch to Splunk
     */
    private sendBatch;
    /**
     * Health check - verify HEC endpoint is accessible
     */
    protected doHealthCheck(): Promise<boolean>;
    /**
     * Convert security event to Splunk HEC format
     */
    private toHECEvent;
    /**
     * Build the event payload for Splunk
     */
    private buildEventPayload;
    /**
     * Get severity name from numeric value
     */
    private getSeverityName;
    /**
     * Mask sensitive parts of URL for logging
     */
    private maskUrl;
}
/**
 * Create a Splunk connector
 */
export declare function createSplunkConnector(config: SplunkConnectorConfig): SplunkConnector;
//# sourceMappingURL=splunk.d.ts.map