# Coverage and call status

> Read the Whisper Splunk add-on's whisper_coverage and whisper_status fields together: what Whisper knows, whether the call completed, and why both matter.

*Source: https://www.whisper.security/docs/integrations/splunk/coverage-and-status*
*Published: 2026-11-08*
*Last updated: 2026-11-08*

---
Every row `whisperlookup` returns carries two separate answers. `whisper_coverage` says what Whisper knows about the indicator. `whisper_status` says whether the call that asked was answered. A failed call has nothing to say about the indicator, and "No data" comes from a call that worked, so reading either field in place of the other turns an outage into a quiet result.

> **Read `coverage` before `band`.** Only `known-clean` licenses the word "clean"; `no-data` means
> *unknown*, which is a different thing again; `malicious-evidenced` and `ambiguous` mean there is
> evidence, whatever the band says.
> Full contract: [Coverage — what we looked at](/docs/whisper-graph/procedures/coverage).

## What Whisper knows: `whisper_coverage`

| `whisper_coverage` | `whisper_coverage_word` | What it means |
|---|---|---|
| `malicious-evidenced` | Evidence of malice | Evidence says the indicator is malicious. |
| `ambiguous` | Contested evidence | The evidence points both ways. |
| `listing-stopped` | Listing stopped | A feed listed it and none lists it now. It is history, not a current listing. |
| `not-answered` | Not answered | No answer came back for this indicator. |
| `no-data` | No data | Whisper holds no record of it, so it is unknown. |
| `known-clean` | Checked, not malicious | Whisper checked it and found nothing malicious. |

The table runs worst first, the order `whisper_marks` gives as `whisper_coverage_rank`. A value Whisper adds after this release passes through unchanged, and `whisper_coverage_word` reads "Unrecognised state:" followed by it; it is never mapped onto one of the six. `whisper_marks` ranks such a value 0, ahead of the six, and gives a row with no coverage, such as a `whisperenrich` row, rank 7 and the mark "Not a verdict". Evidence of malice that Whisper overrides to a band of `LOW` or below is marked "Listed, overridden by Whisper".

`whisper_coverage_disagrees` is `true` when the verdict's label overrides its own evidence, such as a clean label on evidence of malice. When Whisper reports an override, `whisper_advisory` names it and `whisper_advisory_sentence` explains it.

## Whether the call completed: `whisper_status`

| `whisper_status` | `whisper_marks` shows | What it means |
|---|---|---|
| `ok` | Answered | The call completed. Read `whisper_coverage`. |
| `degraded` | ⚠ Answered, degraded | Whisper answered, but the answer may be less than was asked for. |
| `not-checked` | ○ Not sent | Nothing was sent for this indicator. |
| `unavailable` | ✕ Call failed | The call did not complete, so there is no verdict. |

On a `whisperlookup` row, every status other than `ok` comes with `whisper_status_reason`, a short token, and `whisper_status_action`, a sentence that says what to do. [Troubleshooting](/docs/integrations/splunk/troubleshooting#search-time-reasons) lists every reason.

## Reading them together

Keep the rows whose call completed, then filter on what Whisper knows, and count what was left out so it stays visible:

```spl
index=dns earliest=-1h
| stats count by query
| whisperlookup field=query mode=verdict
| eventstats count(eval(whisper_status!="ok")) AS not_answered_rows
| where whisper_status="ok" AND whisper_coverage IN ("malicious-evidenced", "ambiguous")
```

`whisper_band` grades a verdict from `NONE` to `CRITICAL`, and `whisper_band_rank` gives it as a number from 0 to 5. The rank is -1 when there is no band, so a threshold such as `whisper_band_rank>=4` never matches a row it cannot grade. Compare ranks rather than band names, and read the band only after the coverage, as the rule above says.