/**
 * Splunk HEC SIEM Connector
 *
 * Connector for Splunk HTTP Event Collector (HEC) integration.
 * Supports batching, retry, and configurable indexing.
 *
 * @see https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector
 * @packageDocumentation
 */
import type { AuditEvent, ISIEMConnector, SIEMConfig, SIEMConnectorStats } from './types.js';
/**
 * Splunk HEC connector for SIEM integration.
 *
 * Features:
 * - HEC event endpoint support
 * - Configurable source, sourcetype, and index
 * - Automatic batching with flush interval
 * - Exponential backoff retry
 * - Gzip compression support
 * - Token-based authentication
 */
export declare class SplunkConnector implements ISIEMConnector {
    readonly provider: "splunk";
    private config;
    private queue;
    private flushTimer;
    private isShuttingDown;
    private source;
    private sourcetype;
    private index;
    private stats;
    private latencies;
    constructor(config: SIEMConfig);
    /**
     * Check if Splunk HEC is reachable
     */
    healthCheck(): Promise<boolean>;
    /**
     * Send a single event to Splunk
     */
    sendEvent(event: AuditEvent): Promise<void>;
    /**
     * Send a batch of events to Splunk
     */
    sendBatch(events: AuditEvent[]): Promise<void>;
    /**
     * Flush all queued events
     */
    flush(): Promise<void>;
    /**
     * Graceful shutdown
     */
    shutdown(): Promise<void>;
    /**
     * Get connector statistics
     */
    getStats(): SIEMConnectorStats;
    /**
     * Start the periodic flush timer
     */
    private startFlushTimer;
    /**
     * Add event to queue with overflow protection
     */
    private addToQueue;
    /**
     * Push events to Splunk HEC
     */
    private pushToSplunk;
    /**
     * Convert an audit event to Splunk HEC format
     */
    private eventToHECEvent;
    /**
     * Build HTTP headers for Splunk HEC requests
     */
    private buildHeaders;
    /**
     * Update latency statistics
     */
    private updateLatencyStats;
    /**
     * Sleep for a specified duration
     */
    private sleep;
}
/**
 * Create a new Splunk HEC connector instance
 */
export declare function createSplunkConnector(config: SIEMConfig): SplunkConnector;
//# sourceMappingURL=splunk.d.ts.map