/**
 * Splunk sources that stay raw, and the pricing model under which compaction
 * pays.
 *
 * Two facts about Splunk decide whether a source should be compacted at all,
 * before any saving is measured:
 *
 *   - Enterprise Security and the CIM read events through vendor add-ons.
 *     Splunk applies an add-on's extractions to `_raw` at search time, keyed
 *     to the event's sourcetype, before anything in the search pipeline can
 *     expand a compact event. A compacted source is dark to the add-on, so
 *     the data models, correlation searches and dashboards built on it see
 *     nothing. The source stays raw.
 *   - Splunk meters its Cisco sourcetypes at a reduced rate only under their
 *     own sourcetype. Compacted, a Cisco source lands under the 10x sourcetype
 *     at the full rate, and at a third off it meters more than it did raw.
 *
 * And one about the licence: on workload (vCPU) pricing the meter is compute,
 * not bytes. Compaction trims indexing CPU a little and storage by a quarter
 * to a half, while every search that expands events costs about three times
 * the CPU. It is not a saving on that meter.
 *
 * The lists below are literal and explicit on purpose: a sourcetype is kept
 * raw because it is named here, and a user who wants to see why reads this
 * file.
 */
export type SplunkPricing = 'ingest' | 'workload';
/** Destination keys that are Splunk, including the Cloud variant. */
export declare function isSplunkDestination(destination: string | undefined | null): boolean;
/**
 * Sourcetype prefixes Splunk meters at its Cisco rate. The benefit needs the
 * Cisco sourcetype to be preserved, so these stay raw under any licence.
 */
export declare const SPLUNK_CISCO_RATE_PREFIXES: ReadonlyArray<string>;
/**
 * Sourcetype prefixes read by the add-ons Enterprise Security and the CIM
 * data models are built on. Matched case-insensitively on the prefix.
 */
export declare const SPLUNK_ADD_ON_SOURCETYPE_PREFIXES: ReadonlyArray<string>;
export type SplunkKeepRawReason = 'cisco_rate' | 'enterprise_security_add_on';
export interface SplunkKeepRawVerdict {
    reason: SplunkKeepRawReason;
    /** One or two sentences for the plan or the envelope. */
    text: string;
}
/**
 * Why a Splunk source stays raw, or undefined when nothing here says so.
 *
 * `enterpriseSecurity` is what the user said: true or absent keeps the add-on
 * sourcetypes raw (absent is unknown, and unknown is not permission to
 * darken a data model); false, stated by the user, frees them. The Cisco
 * rule does not depend on it.
 */
export declare function splunkKeepRaw(sourcetype: string | undefined | null, opts?: {
    enterpriseSecurity?: boolean;
}): SplunkKeepRawVerdict | undefined;
/** Why compact is not offered on Splunk workload pricing. */
export declare const SPLUNK_WORKLOAD_COMPACT_NOTE: string;