Support

Where to go when something isn't working. We answer faster when you include the right context.

Open a support ticket

Email support@whisper.security. The console's ticket portal — better for tracked, async requests — sits behind the console sign-in: signed out it 404s, which is why that link goes to the sign-in and not straight to the portal.

Include:

1. What you ran. The full Cypher query (or curl command), or the Splunk SPL.
2. What you expected. Briefly.
3. What you got. The full response — headers and body. For Splunk, the search command output and any internal log entries.
4. The request id, and the replica. Every response carries an X-Request-Id and an X-Served-By header, signed in or not — copy both. There is no request_id field in the error body, so read the headers rather than the JSON.
5. The time. Approximate UTC time of the failed request.

For Splunk-specific issues, attach the diag bundle: /opt/splunk/bin/splunk diag --collect TA-whisper-graph. See Splunk Troubleshooting.

Ticket template

Subject: [WhisperGraph] <one-line summary>

Region: <if Splunk Cloud>
Time (UTC): <YYYY-MM-DDTHH:MM:SSZ>

What I ran:
<Cypher / SPL / curl command>

What I expected:
<one or two sentences>

What I got:
<full response or error>

X-Request-Id: <from the response headers>
X-Served-By:  <from the response headers>

Where else to look

A specific error, a query rule or a term you don't recognize is usually answered faster in place than in a ticket:

• Cypher Best Practices — query rules and known limitations
• Splunk Troubleshooting — Splunk-specific issues
• FAQ — the questions that come in most often, answered
• Glossary — definitions for terms you'll see in error messages

Everything else — the HTTP API, Cypher, WhisperGraph, Workflows, Recipes, Agents & MCP — is one click away in the sidebar.