# Support

> WhisperGraph support: how to open a ticket with the right context, the ticket template, and where to look in the docs.

*Source: https://www.whisper.security/docs/support*

---
Where to go when something isn't working. We answer faster when you include the right context.

---

## Open a support ticket

Email [support@whisper.security](mailto:support@whisper.security). The console's ticket portal — better for tracked, async requests — sits behind the [console sign-in](https://console.whisper.security/sign-in): signed out it 404s, which is why that link goes to the sign-in and not straight to the portal.

Include:

1. **What you ran.** The full Cypher query (or curl command), or the Splunk SPL.
2. **What you expected.** Briefly.
3. **What you got.** The full response — headers and body. For Splunk, the search command output and any `internal` log entries.
4. **The request id, and the replica.** Every response carries an `X-Request-Id` and an `X-Served-By` header, signed in or not — copy both. There is no `request_id` field in the error body, so read the headers rather than the JSON.
5. **The time.** Approximate UTC time of the failed request.

For Splunk-specific issues, attach the diag bundle: `/opt/splunk/bin/splunk diag --collect TA-whisper-graph`. See [Splunk Troubleshooting](/docs/integrations/splunk/troubleshooting).

---

## Ticket template

```
Subject: [WhisperGraph] <one-line summary>

Region: <if Splunk Cloud>
Time (UTC): <YYYY-MM-DDTHH:MM:SSZ>

What I ran:
<Cypher / SPL / curl command>

What I expected:
<one or two sentences>

What I got:
<full response or error>

X-Request-Id: <from the response headers>
X-Served-By:  <from the response headers>
```

---

## Where else to look

A specific error, a query rule or a term you don't recognize is usually answered faster in place than in a ticket:

- **[Cypher Best Practices](/docs/cypher/best-practices)** — query rules and known limitations
- **[Splunk Troubleshooting](/docs/integrations/splunk/troubleshooting)** — Splunk-specific issues
- **[FAQ](/faq)** — the questions that come in most often, answered
- **[Glossary](/glossary)** — definitions for terms you'll see in error messages

Everything else — the HTTP API, Cypher, WhisperGraph, Workflows, Recipes, Agents & MCP — is one click away in the sidebar.