/**
 * Splunk connector.
 *
 * Thin REST wrapper over the Splunk search-job API. The official Node SDK
 * is sparsely maintained, so we use fetch directly:
 *   1. POST /services/search/jobs         → search job sid
 *   2. GET  /services/search/jobs/{sid}   → poll `isDone`
 *   3. GET  /services/search/jobs/{sid}/results?offset=N&count=1000 → paginate
 *
 * Auth: `SPLUNK_HOST` + `SPLUNK_TOKEN` (bearer). Also honors `~/.splunkrc`
 * which users of the Splunk CLI often have set up.
 */
import type { SiemConnector } from './index.js';
/**
 * Stratified-sampling bucket count for Splunk pulls. Lower than the other
 * connectors on purpose: Splunk dispatches one search job per bucket and the
 * search head's default per-user concurrency cap is 6.
 *
 * Exported for the offline export-plan emitter, which must draw the same
 * sample this connector draws. See CLOUDWATCH_BUCKET_COUNT.
 */
export declare const SPLUNK_BUCKET_COUNT = 12;
/** Results page size used against `search/jobs/{sid}/results`. */
export declare const SPLUNK_PAGE_SIZE = 1000;
/**
 * SPLUNK_INSECURE=1 skips certificate verification for the search head only.
 * A default Splunk install serves port 8089 with its own self-signed
 * certificate, issued to "SplunkServerDefaultCert", so neither the system CA
 * store nor NODE_EXTRA_CA_CERTS can verify it (the hostname never matches).
 * Global fetch cannot relax verification per request without a newer undici
 * than Node 20 ships, and NODE_TLS_REJECT_UNAUTHORIZED would relax it for
 * every connection this process makes, so this path uses node:https with
 * rejectUnauthorized:false for Splunk requests alone. Opt-in, never default;
 * the emitted export script offers the same choice (--insecure).
 */
export declare function splunkInsecure(): boolean;
/**
 * "fetch failed" alone says nothing; the reason is on the cause chain
 * (a certificate the process does not trust, a refused connection, DNS).
 * Name it, and say what fixes the common ones.
 */
export declare function describeSplunkError(e: unknown): string;
export declare const splunkConnector: SiemConnector;