Support
Open a ticket with the context that gets it answered on the first reply: the request id, the replica that served you, and the query you ran.
On this page (3)
Support Documentation
Where to go when something isn't working. We answer faster when you include the right context.
Open a support ticket
Email support@whisper.security. The console's ticket portal — better for tracked, async requests — sits behind the console sign-in: signed out it 404s, which is why that link goes to the sign-in and not straight to the portal.
Include:
- What you ran. The full Cypher query (or curl command), or the Splunk SPL.
- What you expected. Briefly.
- What you got. The full response — headers and body. For Splunk, the search command output and any
internallog entries. - The request id, and the replica. Every response carries an
X-Request-Idand anX-Served-Byheader, signed in or not — copy both. There is norequest_idfield in the error body, so read the headers rather than the JSON. Replicas differ in freshness, and that pair is usually the fastest explanation for it worked a minute ago. - The time. Approximate UTC time of the failed request.
For Splunk-specific issues, attach the diag bundle: /opt/splunk/bin/splunk diag --collect TA-whisper-graph. See Splunk Troubleshooting.
Ticket template
text
Subject: [WhisperGraph] <one-line summary>
Region: <if Splunk Cloud>
Time (UTC): <YYYY-MM-DDTHH:MM:SSZ>
What I ran:
<Cypher / SPL / curl command>
What I expected:
<one or two sentences>
What I got:
<full response or error>
X-Request-Id: <from the response headers>
X-Served-By: <from the response headers>
Where else to look
- Whisper API — the endpoints, the response envelope, and the error reference with recovery steps
- Cypher Best Practices — query rules and known limitations
- Cypher Reference — the read-only dialect: syntax, clauses, functions, cheat sheet
- Whisper Graph — schema, threat feeds, and procedures
- Use Cases — runnable workflows and copy-paste recipes
- AI & Agents — MCP setup and reference
- Splunk Troubleshooting — Splunk-specific issues
- FAQ — the questions that come in most often, answered
- Glossary — definitions for terms you'll see in error messages