Coverage and call status

The two fields on every Whisper row in Splunk: whisper_coverage says what Whisper knows, whisper_status says whether the call completed.

Published 8 November 2026Last updated 8 November 2026Figures verified 8 November 2026

On this page (3)

What Whisper knows: whisper_coverage
Whether the call completed: whisper_status
Reading them together

Every row whisperlookup returns carries two separate answers. whisper_coverage says what Whisper knows about the indicator. whisper_status says whether the call that asked was answered. A failed call has nothing to say about the indicator, and "No data" comes from a call that worked, so reading either field in place of the other turns an outage into a quiet result.

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. Full contract: Coverage — what we looked at.

What Whisper knows: `whisper_coverage`

`whisper_coverage`	`whisper_coverage_word`	What it means
malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice.	Evidence of malice	Evidence says the indicator is malicious.
ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways.	Contested evidence	The evidence points both ways.
`listing-stopped`	Listing stopped	A feed listed it and none lists it now. It is history, not a current listing.
`not-answered`	Not answered	No answer came back for this indicator.
no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at.	No data	Whisper holds no record of it, so it is unknown.
known-clean — coverage: known-clean. In coverage, no malicious evidence.	Checked, not malicious	Whisper checked it and found nothing malicious.

The table runs worst first, the order whisper_marks gives as whisper_coverage_rank. A value Whisper adds after this release passes through unchanged, and whisper_coverage_word reads "Unrecognised state:" followed by it; it is never mapped onto one of the six. whisper_marks ranks such a value 0, ahead of the six, and gives a row with no coverage, such as a whisperenrich row, rank 7 and the mark "Not a verdict". Evidence of malice that Whisper overrides to a band of LOW or below is marked "Listed, overridden by Whisper".

whisper_coverage_disagrees is true when the verdict's label overrides its own evidence, such as a clean label on evidence of malice. When Whisper reports an override, whisper_advisory names it and whisper_advisory_sentence explains it.

Whether the call completed: `whisper_status`

`whisper_status`	`whisper_marks` shows	What it means
`ok`	Answered	The call completed. Read `whisper_coverage`.
`degraded`	⚠ Answered, degraded	Whisper answered, but the answer may be less than was asked for.
`not-checked`	○ Not sent	Nothing was sent for this indicator.
`unavailable`	✕ Call failed	The call did not complete, so there is no verdict.

On a whisperlookup row, every status other than ok comes with whisper_status_reason, a short token, and whisper_status_action, a sentence that says what to do. Troubleshooting lists every reason.

Reading them together

Keep the rows whose call completed, then filter on what Whisper knows, and count what was left out so it stays visible:

spl

index=dns earliest=-1h
| stats count by query
| whisperlookup field=query mode=verdict
| eventstats count(eval(whisper_status!="ok")) AS not_answered_rows
| where whisper_status="ok" AND whisper_coverage IN ("malicious-evidenced", "ambiguous")

whisper_band grades a verdict from NONE to CRITICAL, and whisper_band_rank gives it as a number from 0 to 5. The rank is -1 when there is no band, so a threshold such as whisper_band_rank>=4 never matches a row it cannot grade. Compare ranks rather than band names, and read the band only after the coverage, as the rule above says.