# Splunk Integration

> Whisper Security Add-on for Splunk — IOC enrichment, ad-hoc graph queries, threat intelligence, and attack-surface monitoring across your Splunk indexes.

*Source: https://www.whisper.security/docs/integrations/splunk/overview*
*Published: 2026-04-06*
*Last updated: 2026-09-19*

---
Whisper Splunk connects your Splunk environment to WhisperGraph — billions of nodes, tens of billions of edges, and millions of threat intelligence edges across 134 feed sources. Enrich IOCs, run ad-hoc graph queries, populate ES threat intel, and monitor your owned attack surface — all from within Splunk.

> **Get the add-on:** [Whisper Security TA on Splunkbase →](https://splunkbase.splunk.com/app/8695)

---

The add-on, `TA-whisper-graph`, covers three workflows: enrich your logs, investigate one indicator interactively, and monitor your owned domains. Its Enterprise Security pieces are opt-in and disabled by default, so Splunk ES is optional.

> **Read `coverage` before `band`.** Only `known-clean` licenses the word "clean"; `no-data` means
> *unknown*, which is a different thing again; `malicious-evidenced` and `ambiguous` mean there is
> evidence, whatever the band says.
> Full contract: [Coverage — what we looked at](/docs/whisper-graph/procedures/coverage).

## Getting started

| Step | Guide |
|------|-------|
| 1. Check requirements | [Requirements](/docs/integrations/splunk/install#requirements) |
| 2. Install the add-on | [Installation](/docs/integrations/splunk/install) |
| 3. Configure your API key | [Configuration](/docs/integrations/splunk/install#configure-the-add-on) |
| 4. Enrich your first events | [Search Commands](/docs/integrations/splunk/using-it#search-commands) |

## Where to go next

- [Install & Configure](/docs/integrations/splunk/install) — requirements, single-instance, distributed and Splunk Cloud installs, and every add-on setting.
- [Deployment Architecture](/docs/integrations/splunk/deployment-architecture) — where the add-on runs in a distributed deployment: search-head clusters, the deployment server, indexer clusters and forwarders.
- [Using It](/docs/integrations/splunk/using-it) — the search commands, the enrichment pipeline end to end, and the scheduled inputs that watch your domains, IPs and ASNs.
- [Dashboards](/docs/integrations/splunk/dashboards) — the pre-built investigation, attack-surface, compliance and add-on-health views.
- [Enterprise Security](/docs/integrations/splunk/es-integration) — threat-intel collections, the adaptive response action, CIM field aliases, and how to build your own detections.
- [Reference](/docs/integrations/splunk/reference) — every sourcetype, field alias, lookup, collection, macro and saved search the add-on ships, with a status on each row.
- [Troubleshooting](/docs/integrations/splunk/troubleshooting) — common errors, diagnostic commands, log locations and where to get support.
- [Changelog](/docs/integrations/splunk/changelog) — what shipped in the version you can install.

Writing the queries themselves is covered by the [Cypher reference](/docs/cypher), and worked investigations by [Workflows](/docs/workflows).