Deployment Architecture

The TA runs entirely on search heads. Indexers and forwarders require no additional configuration.

*Only if field extractions are needed at index time. For most deployments, search-time extraction (default) is sufficient.

The TA does not ship indexes.conf: Splunk Cloud Victoria Experience prohibits app-shipped index definitions. The deployment administrator must create the whisper index before enabling modular inputs. See Installation -> Create the whisper index for step-by-step instructions for Cloud Victoria, Cloud Classic, and Splunk Enterprise.

All outbound API calls to the Whisper Knowledge Graph originate exclusively from search heads. Ensure your firewall allows outbound HTTPS (port 443) from search heads to graph.whisper.security (or your configured API base URL).

No indexers, forwarders, or other Splunk components make API calls.

To deploy the TA via Deployment Server to search heads:

1. Place the TA in the deployment apps directory:

   textCopy

   $SPLUNK_HOME/etc/deployment-apps/TA-whisper-graph/
   

2. Configure serverclass.conf to target search heads only:

   iniCopy

   [serverClass:whisper_security]
   whitelist.0 = search-head-*.example.com
   
   [serverClass:whisper_security:app:TA-whisper-graph]
   restartSplunkd = true
   

3. Push the deployment:

   bashCopy

   splunk reload deploy-server
   

Do not deploy to indexers or forwarders -- the TA is not needed there.

Deploying via SHC Deployer

1. Place the TA on the deployer:

   textCopy

   $SPLUNK_HOME/etc/shcluster/apps/TA-whisper-graph/
   

2. Push the bundle:

   bashCopy

   splunk apply shcluster-bundle -target https://<captain>:8089 --answer-yes
   

KV Store Replication

KV Store collections automatically replicate across SHC members. No additional configuration is needed. The TA's server.conf includes:

[shclustering]
conf_replication_include.ta_whisper_graph_settings = true

To verify KV Store replication status:

| rest /services/kvstore/status

Modular Input Behavior

Modular inputs run on all SHC members by default. For inputs that should run on only one member (to avoid duplicate data collection), configure the captain to manage input scheduling, or disable inputs on non-captain members.

No TA installation is required on indexers. The TA runs entirely on search heads.

If you want the whisper index on your indexer cluster, create your own indexes.conf in a cluster-master apps bundle (the TA does not ship one — Splunk Cloud Victoria forbids it):

$SPLUNK_HOME/etc/manager-apps/whisper-indexes/default/indexes.conf

[whisper]
homePath = $SPLUNK_DB/whisper/db
coldPath = $SPLUNK_DB/whisper/colddb
thawedPath = $SPLUNK_DB/whisper/thaweddb
frozenTimePeriodInSecs = 15552000
repFactor = auto

Then push the bundle: splunk apply cluster-bundle. The repFactor = auto setting ensures proper replication across indexer cluster peers.

The TA does not run on universal or heavy forwarders. All data collection is performed by modular inputs running on the search head, which call the Whisper API directly.

Forwarders can send raw network events (e.g., proxy logs, firewall logs) to indexers. Those events can then be enriched at search time using whisperlookup on the search head.

Victoria Experience

• The TA installs on the search head via the Splunk Cloud self-service app install
• Modular inputs run locally on the search head -- full compatibility
• KV Store is accessible from the search head
• All features work without additional configuration

Classic Experience (IDM)

In Classic Experience, modular inputs run on the Inputs Data Manager (IDM), a separate Splunk instance that does not have access to KV Store.

The TA uses an event-based architecture to support this deployment:

1. Modular inputs (whisper_threat_intel, whisper_watchlist) write enrichment data as events to the whisper index instead of writing directly to KV Store
2. Saved searches (disabled by default) read these events and populate KV Store collections on the search head via outputlookup

To enable the event-based pipeline on Classic Experience:

1. Enable the modular inputs via the TA configuration page
2. Enable the following saved searches:
   • Whisper - Populate IP Threat Intel KV Store
   • Whisper - Populate Domain Threat Intel KV Store
   • Whisper - Populate Precomputed Enrichment KV Store
3. Configure the saved search schedules to run after the input collection intervals

Firewall Requirements

Allow outbound HTTPS (port 443) from search heads to:

• graph.whisper.security (production API)
• Or your configured API base URL

AppInspect

CI runs the splunk-appinspect CLI against the packaged add-on on every commit, with the cloud, private_victoria and private_classic tag sets among others. Re-run on the shipped 1.0.0 package on 2026-08-09, all three report zero failures and zero errors.

AppInspect is not Cloud Vetting. AppInspect is automated static analysis that any developer can run; Cloud Vetting is Splunk's own review, including manual checks, and only a Splunk Cloud customer can trigger it by requesting the install. The per-tag results are on Requirements.

The TA runs identically on Splunk Enterprise, Splunk Cloud Classic, and Splunk Cloud Victoria. Feature coverage is the same across all three platforms; only the management plane and modular-input host differ.

Capability matrix

Cloud Classic vs Cloud Victoria

Which objects need an API key

Search commands and dashboards work on a fresh install with no key configured. Two investigation macros do not: whisper_cname_chain and whisper_spf_chain are refused unless the search head sends a key.

Configure a key in Configuration > Account on every search head that will run them — see Requirements.

*Only needed on indexers if index-time field extractions are configured.

Inputs Not Running (SHC)

If modular inputs are not collecting data on an SHC:

1. Verify the TA is deployed on all SHC members
2. Check that inputs are enabled: Settings > Data Inputs > Whisper
3. Verify API connectivity: run | whisperquery query="CALL whisper.version()" from the search bar. It returns the engine version and build time when the search head can reach the API

Inputs Not Running (Splunk Cloud Classic)

If using Classic Experience with IDM:

1. Verify the event-based saved searches are enabled
2. Check that events are being written: search for index=whisper sourcetype=whisper:threat_intel
3. If events exist but KV Store is empty, verify the saved searches are running on schedule

KV Store Replication Issues (SHC)

Verify replication is working:

| rest /services/kvstore/status
| table title, currentStatus, replicationStatus

If collections are not replicating, verify server.conf includes the replication settings.