# Upgrade to 2.0.0

> Upgrade the Whisper Splunk add-on from 1.0.0 to 2.0.0: the steps to take first, what changes for your searches, files to remove, and how to roll back.

*Source: https://www.whisper.security/docs/integrations/splunk/upgrade*
*Published: 2026-11-08*
*Last updated: 2026-11-08*

---
2.0.0 installs over 1.0.0 as an upgrade, because the package id, `TA-whisper-graph`, is unchanged. It collects nothing on a schedule and drops five of 1.0.0's six collections, so two steps have to happen on 1.0.0 first.

## Before you upgrade

On 1.0.0:

1. Disable the three modular inputs: **Whisper ES Threat Intel Feed**, **Whisper Attack Surface Baseline** and **Whisper Watchlist Enrichment**. 2.0.0 has no Inputs page, so afterwards Splunk Web cannot reach them, and an input left enabled keeps running and failing.
2. Export the watchlist from the Search app. Its collection is one of those 2.0.0 drops, and its rows cannot be read once 2.0.0 is installed:

```spl
| inputlookup whisper_watchlist | outputlookup create_empty=false whisper_watchlist_export_2026.csv
```

The exported file is then the only copy of the watchlist.

## Install 2.0.0

Install it over the existing installation, as [Install and configure](/docs/integrations/splunk/install#install-the-add-on) describes. Then, as an administrator, on **Configuration › Account**:

1. Paste the API key again. 2.0.0 keeps its account in a new place, so the 1.0.0 key does not carry over.
2. Tick **Send indicators to Whisper Security** and save. Until this save, every command that calls Whisper reports `consent-required` and sends nothing.
3. If the page still shows 1.0.0's form, hard-refresh it in your browser.

After that first save, the Account tab counts your saved searches, dashboards and macros that name a withdrawn macro, lookup, sourcetype or collection, the watchlist and DNS baseline aside, and the saved searches and dashboards that use one of nine retired fields with `whisperlookup`. Check the other fields by hand.

## What changes for your searches

- **`whisperlookup` keeps seven of its 1.0.0 fields:** `whisper_type` and `whisper_is_threat`, plus `whisper_ip`, `whisper_prefix`, `whisper_asn`, `whisper_asn_name` and `whisper_country` in `mode=context`. [Retired field names](/docs/integrations/splunk/troubleshooting#retired-field-names) says where the others are now. On a domain row, `whisper_is_threat` now comes from the domain's own verdict, not its first address.
- **Yes-or-no fields read `true` or `false`**, not `1` or `0`, so write `whisper_is_threat="true"`.
- **`whisperschema` renames its columns** to `whisper_` fields; the troubleshooting page maps each one.
- **`whisperquery` answers a failure with one row** carrying `whisper_status`, not zero events, and its row count and timing are now `whisper_rows` and `whisper_elapsed_ms`.
- **`whisperflush` needs `mode=expired` or `mode=all`**; a bare one deletes nothing. `whisperevict` is deprecated and runs `mode=expired`.
- **`whisperlookup`'s five 1.0.0 options** still parse, change nothing and warn once per search.
- **`whisper_user` no longer grants the `whisper` index.** If your searches read it, grant it on a role of your own.
- **The 1.0.0 proxy URL** keeps working while no proxy host is set, unless it holds a user name and password: 2.0.0 refuses that one, and every command fails until you re-enter it. Re-enter it in the separate proxy fields on the Settings tab either way.

## What 2.0.0 removes

- The three modular inputs and the Inputs page.
- Every saved search. The enrichment cache now clears its own expired rows.
- The **Enrich with Whisper** adaptive response action.
- Five CSV lookups: `whisper_high_risk_asns`, `whisper_cdn_asns`, `whisper_dns_providers`, `whisper_org_asns` and `whisper_risk_factors`. A search that reads one stops working.
- The Common Information Model mapping, with its event types and tags.
- Four sourcetypes: `whisper:enrichment`, `whisper:attack_surface`, `whisper:change` and `whisper:spf_compliance`. 2.0.0 writes no events, so nothing new arrives under them.
- Four dashboards: `whisper_attack_surface_timeline`, `whisper_compliance_summary`, `whisper_mail_config` and `whisper_spf_compliance`.
- Six macros from 1.0.0. `whisperenrich`, or a `whisperquery` of your own, answers what five of them asked; the sixth named an index no installation has.

## Remove what the upgrade leaves behind

An in-place install adds and overwrites files but deletes none, so 1.0.0's dashboards, Inputs page, saved searches, alert action, input types, event types, tags and lookup files stay installed, and most of them fail when used. The Account tab's count leaves them out.

On Splunk Enterprise, remove them and restart. Check for a `local/` copy of each one first: a `local/` file keeps its object registered after the `default/` file is gone.

```bash
APP="$SPLUNK_HOME/etc/apps/TA-whisper-graph"
rm "$APP/default/savedsearches.conf" "$APP/default/alert_actions.conf" \
   "$APP/default/inputs.conf" "$APP/README/inputs.conf.spec" \
   "$APP/default/eventtypes.conf" "$APP/default/tags.conf"
rm "$APP"/default/data/ui/views/{whisper_attack_surface_timeline,whisper_compliance_summary,whisper_mail_config,whisper_spf_compliance,inputs}.xml
rm "$APP"/lookups/{whisper_high_risk_asns,whisper_cdn_asns,whisper_dns_providers,whisper_org_asns,whisper_risk_factors}.csv
"$SPLUNK_HOME/bin/splunk" restart
```

On Splunk Cloud there is no filesystem access. Remove the add-on and install 2.0.0 fresh, then enter the key and the acknowledgement again, or open a Splunk Support case. On a host you have not upgraded yet, removing the add-on before you install 2.0.0 leaves nothing behind.

## Roll back to 1.0.0

On Splunk Enterprise, install the 1.0.0 package over 2.0.0. That restores the 1.0.0 account and key, its proxy setting, your input stanzas, and your `local/` copies of its dashboards and saved searches. The watchlist comes back only from your export:

```spl
| inputlookup whisper_watchlist_export_2026.csv | outputlookup whisper_watchlist
```

Searches built on 2.0.0's fields, such as `whisper_coverage` and `whisper_status`, stop matching, because 1.0.0 never emits them. On Splunk Cloud Victoria Experience, an `sc_admin` moves back to 1.0.0 with an ACS app update that names the version; on Classic Experience, ask Splunk Cloud Support.