Upgrade to 2.0.0

2.0.0 installs over 1.0.0 as an upgrade, because the package id, TA-whisper-graph, is unchanged. It collects nothing on a schedule and drops five of 1.0.0's six collections, so two steps have to happen on 1.0.0 first.

Before you upgrade

On 1.0.0:

1. Disable the three modular inputs: Whisper ES Threat Intel Feed, Whisper Attack Surface Baseline and Whisper Watchlist Enrichment. 2.0.0 has no Inputs page, so afterwards Splunk Web cannot reach them, and an input left enabled keeps running and failing.
2. Export the watchlist from the Search app. Its collection is one of those 2.0.0 drops, and its rows cannot be read once 2.0.0 is installed:

| inputlookup whisper_watchlist | outputlookup create_empty=false whisper_watchlist_export_2026.csv

The exported file is then the only copy of the watchlist.

Install 2.0.0

Install it over the existing installation, as Install and configure describes. Then, as an administrator, on Configuration › Account:

1. Paste the API key again. 2.0.0 keeps its account in a new place, so the 1.0.0 key does not carry over.
2. Tick Send indicators to Whisper Security and save. Until this save, every command that calls Whisper reports consent-required and sends nothing.
3. If the page still shows 1.0.0's form, hard-refresh it in your browser.

After that first save, the Account tab counts your saved searches, dashboards and macros that name a withdrawn macro, lookup, sourcetype or collection, the watchlist and DNS baseline aside, and the saved searches and dashboards that use one of nine retired fields with whisperlookup. Check the other fields by hand.

What changes for your searches

• whisperlookup keeps seven of its 1.0.0 fields: whisper_type and whisper_is_threat, plus whisper_ip, whisper_prefix, whisper_asn, whisper_asn_name and whisper_country in mode=context. Retired field names says where the others are now. On a domain row, whisper_is_threat now comes from the domain's own verdict, not its first address.
• Yes-or-no fields read true or false, not 1 or 0, so write whisper_is_threat="true".
• whisperschema renames its columns to whisper_ fields; the troubleshooting page maps each one.
• whisperquery answers a failure with one row carrying whisper_status, not zero events, and its row count and timing are now whisper_rows and whisper_elapsed_ms.
• whisperflush needs mode=expired or mode=all; a bare one deletes nothing. whisperevict is deprecated and runs mode=expired.
• whisperlookup's five 1.0.0 options still parse, change nothing and warn once per search.
• whisper_user no longer grants the whisper index. If your searches read it, grant it on a role of your own.
• The 1.0.0 proxy URL keeps working while no proxy host is set, unless it holds a user name and password: 2.0.0 refuses that one, and every command fails until you re-enter it. Re-enter it in the separate proxy fields on the Settings tab either way.

What 2.0.0 removes

• The three modular inputs and the Inputs page.
• Every saved search. The enrichment cache now clears its own expired rows.
• The Enrich with Whisper adaptive response action.
• Five CSV lookups: whisper_high_risk_asns, whisper_cdn_asns, whisper_dns_providers, whisper_org_asns and whisper_risk_factors. A search that reads one stops working.
• The Common Information Model mapping, with its event types and tags.
• Four sourcetypes: whisper:enrichment, whisper:attack_surface, whisper:change and whisper:spf_compliance. 2.0.0 writes no events, so nothing new arrives under them.
• Four dashboards: whisper_attack_surface_timeline, whisper_compliance_summary, whisper_mail_config and whisper_spf_compliance.
• Six macros from 1.0.0. whisperenrich, or a whisperquery of your own, answers what five of them asked; the sixth named an index no installation has.

Remove what the upgrade leaves behind

An in-place install adds and overwrites files but deletes none, so 1.0.0's dashboards, Inputs page, saved searches, alert action, input types, event types, tags and lookup files stay installed, and most of them fail when used. The Account tab's count leaves them out.

On Splunk Enterprise, remove them and restart. Check for a local/ copy of each one first: a local/ file keeps its object registered after the default/ file is gone.

APP="$SPLUNK_HOME/etc/apps/TA-whisper-graph"
rm "$APP/default/savedsearches.conf" "$APP/default/alert_actions.conf" \
   "$APP/default/inputs.conf" "$APP/README/inputs.conf.spec" \
   "$APP/default/eventtypes.conf" "$APP/default/tags.conf"
rm "$APP"/default/data/ui/views/{whisper_attack_surface_timeline,whisper_compliance_summary,whisper_mail_config,whisper_spf_compliance,inputs}.xml
rm "$APP"/lookups/{whisper_high_risk_asns,whisper_cdn_asns,whisper_dns_providers,whisper_org_asns,whisper_risk_factors}.csv
"$SPLUNK_HOME/bin/splunk" restart

On Splunk Cloud there is no filesystem access. Remove the add-on and install 2.0.0 fresh, then enter the key and the acknowledgement again, or open a Splunk Support case. On a host you have not upgraded yet, removing the add-on before you install 2.0.0 leaves nothing behind.

Roll back to 1.0.0

On Splunk Enterprise, install the 1.0.0 package over 2.0.0. That restores the 1.0.0 account and key, its proxy setting, your input stanzas, and your local/ copies of its dashboards and saved searches. The watchlist comes back only from your export:

| inputlookup whisper_watchlist_export_2026.csv | outputlookup whisper_watchlist

Searches built on 2.0.0's fields, such as whisper_coverage and whisper_status, stop matching, because 1.0.0 never emits them. On Splunk Cloud Victoria Experience, an sc_admin moves back to 1.0.0 with an ACS app update that names the version; on Classic Experience, ask Splunk Cloud Support.