I was curious if anyone else here has done a deep dive on it, even it it’s a little dusty. It would be good to see someone else’s thoughts, especially if it’s been a while, and compare those ideas to the present.
Here are my notes, quite a bit out of date. Again, I’m not sure why I exited this one either, but I think it had gone nowhere in a long time and were paying enormous amounts of stock based comp, but my timing was bad, and I think I remember that they took off shortly after I sold. Sorry, it’s a lot of notes. Probably too long to post in one post and I may have to use two or three.
May 2014 – Original Recommendation that got me interested
• A massive influx of data during the next decade provides a huge opportunity.
• The disruptive pricing model gives it excellent operating leverage.
• Customers love the platform and tend to stick with it.
• Headquarters: San Francisco
• Website: www.splunk.com
• Market Cap: $5.44 billion
• Cash/Debt: $898 million / $0
• Revenue (2011/'12/'13): $121 million / $199 million / $303 million
• Earnings (2011/'12/'13): ($11 million) / ($37 million) / ($79 million)
• Recent Price: $46
A New Way to Dig Into Big Data
Splunk licenses software that helps businesses monitor their performance. Its software is already being used to understand shoppers’ behavior, fleet performance, and website security threats. And with the Internet of Things, there’s going to be lots more data for Splunk to interpret.
As a bit of background, for years, huge companies like Oracle, SAP, and IBM made a killing by building application-specific systems to analyze structured sets of data. Think of it like collecting the daily returns of individual companies (structured data) and compiling it into information about your portfolio’s performance (application-specific). This is useful in certain cases, but it requires a company to define a very specific task for the data and to have a big budget to customize the data to specific needs.
Splunk offers its clients a different way to dig into data. The company collects, indexes, and analyzes unstructured machine data, which is generated farther upstream than the more application-specific numbers. Machine data is unfiltered but contains important bits of information, such as a member ID number or the length of time someone had to wait to get a customer agent on the line. It can come from any device capable of collecting and transmitting digital signals, such as cellphones, traffic lights, airplanes, and even elevators . (Splunk shows machine data in action in this fun tutorial video.) Machine data is messy, and it’s a chore to make sense of. But Splunk has built a niche in deciphering it and presenting it in a user-friendly way.
Having access to this data creates a better view of how a company’s business is operating. That gives Splunk’s software a strong, two-part value proposition. First, companies save money because of reduced downtime, and lower overall cost than the application-specific systems. But they can also improve their decision-making thanks to Splunk’s real-time insights that can monitor almost any part of their business.
Growth and Financials - We think Splunk is in the perfect position to ride the IoT incoming data wave. It already does $300 million in annual revenue and has more than 7,000 customers, claiming more than two-thirds of the Fortune 100 as clients.
Impressive as that is, Splunk just getting started. Its pricing model is to offer its software as a free trial for 60 days and then license and charge based on peak indexing capacity. As customers collect and interpret bigger sums of data, they pay more in fees to Splunk.
This model is helping Splunk disrupt the industry. Smaller businesses don’t have the manpower or the budget to use a fully customized data solution from the likes of Oracle, but Splunk offers them a more efficient solution at a lower cost. Splunk’s individual license revenues might be small at first, but they’ll grow alongside its clients’ businesses as the software gets used for more functions. With time, customers become more familiar with the platform, which makes them less likely to abandon Splunk for a competitor.
This gives Splunk a fair amount of operational leverage. While revenue has more than quadrupled in the past three years (an impressive feat itself), free cash flow has increased tenfold. Splunk now generates more than 20% of revenue as cash. It spends liberally to attract new customers, but the cost to maintain those relationships should decrease with time. Watch for their margins to keep improving as more businesses adopt the platform.
Fiscal 2014 Fiscal 2013 Fiscal 2012 Fiscal 2011
Revenue 303 199 121 66
Net Income ($79.0) ($36.7) ($11.0) ($3.8)
Cash from Operations $73.8 $46.6 $14.6 $8.4
Capital Expenditures ($9.3) ($9.1) ($8.2) ($1.5)
Free Cash Flow 64.5 37.5 6.4 6.9
Free Cash Flow Margin 21.3% 18.8% 5.3% 10.4%
(Look above at Cash from Operations and Free Cash Flow)
Lastly, it’s creating a network effect to retain its customers. It gives tech departments free software-development kits so they can customize their solutions. It also manages online communities for users to build their own open-source applications and answer one another’s questions. Three-quarters of the questions on Splunk Answers are answered by non-Splunk employees, a testament to their base of highly engaged users.
That growing network effect, along with Splunk’s high switching costs, resulted in an enviable 94% customer renewal rate for the most recent quarter.
Risks and When We’d Sell - Splunk’s stock never trades cheap. It’s priced at 18 times trailing revenue. As with other hot-shot stocks, Splunk will need to continue to execute, both in adding new users and keeping existing ones, to justify its pricey multiple.
What’s more, customers’ IT budgets are only so big, so Splunk need to ensure that its solutions are the very best. Expect to see heavy competition from all directions: customized enterprise software providers (such as IBM or Intel), business intelligence providers (such as Qlik), and even web analytics providers (like Google). We’ll want to see Splunk continue to invest heavily in R&D and sales and marketing to stay relevant and to woo new customers from competitors.
There’s one final risk in investing in Splunk: The vast majority of its business is tied to its operational intelligence platform. Because of this concentration, any extended downtime or a security breach in that service could do short-term damage to the company’s reputation. In the longer term, if Splunk’s intellectual property were to show signs of becoming obsolete or irrelevant, we’d have to reconsider this investment.
The Foolish Bottom Line - Splunk is growing quickly in a risky new market with vast potential. It will surely attract competition, but Splunk is a step ahead of anyone else in operational intelligence, and its fantastic renewal rates give it sound footing. As companies tap into the Internet of Things, they’ll need outstanding software to help them make sense of the new data, so now is a great time for you to start a position in Splunk.
March 2016 – Bert’s Take - Is the share price outrageous?
It’s been in an extended downtrend since last summer and is 36% lower than 5 months ago.
It continues to beat consensus significantly and raises guidance almost continuously.
It has a unique and perhaps under-appreciated business model that will, over time, lead to significant levels of product revenue without additional costs.
While there are plenty of competitors, the specific solution set that Splunk offers is simply not offered by large or formidable competitors.
The level of stock-based comp is disquieting and will undoubtedly cause many potential investors to avoid it.
What’s going on with Splunk’s share price?
Splunk announced the results of its Jan 2016 fiscal year in Feb. The results were a blowout. And yet, the shares basically have done nothing to reflect the strength of the quarter or the forward guidance. The shares are still down by 36% since they made their 2015 high.
Yes, the shares still are highly valued, but far less so than at any time in the 4 years that it has been public.
Yes, Splunk will not make GAAP profits for some time to come, but it is certainly starting to generate a meaningful amount of cash.
I think it is time to examine some of the negative arguments that have apparently been weighing on the shares and try to present the case that Splunk shares are significantly undervalued at their current price. A controversial thesis? Yes, but I see a lot to like in both the company and the stock!
How to play Big Data analytics? You’ve heard a lot about Big Data for the past several years. Some will say, it’s outrageously valued both in absolute terms and relative to its peers! But when you really look closer, the objection seems to shrivel before your eyes.
Splunk is, and is likely to remain, the leader in what it does which is to "make machine data accessible, usable and valuable to everyone.” The key is in the words “useable” and “valuable.” Basically, Splunk is all about data analytics, and the ability to actually get value from all of the multiple data sources that flow into modern enterprises, but which are totally useless unless they can be catalogued, indexed, and used, as part of a predictive analytics platform. The flagship product also has features that, in combination with other cybersecurity platforms, can help determine if the data being indexed has in some way been corrupted.
Splunk has never been a cheap stock. However, its cheaper today than they have been at any time since it went public back in 2012. It spends an enormous amount of money on sales and marketing. It really did spend 82% of its revenues on sales and marketing last year, up from 76% the year before.
The people who run Splunk are neither fools or knaves, nor have agendas that are opposed to shareholder values. On the surface, it seems scarcely credible that Splunk would spend 82% of its current revenues on sales and marketing. So, why has it elected to pursue what seems like such a ruinous strategy? Basically, the reason why it is comfortable with that kind of spend rate is that the customers it lands today will almost inevitably spend several times or multiple times their initial purchase on Splunk over the years.
Splunk has a somewhat unique pricing model in that users buy a license for a fixed amount of data to go through software indexers, and then must pay overage charges when additional data goes through. Every year, the volume of data rises at most enterprises by as much as 50%. The bet that Splunk is making is that the huge costs associated with customer acquisition are going to be amortized over the years, over a substantially higher amount of revenue than that which is being currently reported, and without any additional acquisition costs. I will discuss the pricing model in a bit more detail later on, but that model is one of the reasons why Splunk is likely to be one of the more profitable enterprise software vendors over the next decade.
In its last quarter, ASPs more than doubled from year-earlier levels. The basic reason for the steep rise in ASPs is an option called Enterprise Adoption Agreements (EAA), which, in return for much higher fixed prices, does away with overage pricing. EAAs cost far more than standard Splunk licenses, and while their adoption is very far from universal, they led to record number of large deals last quarter.
That being said, Splunk still booked 53% of its business on ratable contracts last quarter, a record. While the EAAs might seem to put a limit on growth of fees, in point of fact, data volumes and use cases are growing so fast that they typically slop over the contractual limits of the EAAs.
If we look back on the decisions to spend a fortune on S&M and to use non-GAAP measures in measuring profitability, the tactics were correct and have led to great results for investors!
Splunk’s biggest competitors are really not Oracle or IBM, but homemade data logs that produce primitive analytics. As a user, you could go out and buy pieces of software from loads of different vendors to do what Splunk does and attempt to build a Big Data analytics solution internally. Most Big Data projects fail because of this.
What Splunk does is relatively complex in that it takes several quite different processes and integrates them into a single, easy-to-use application. There used to be a variety of software companies which were organized on doing pieces of what Splunk does.
The amount of data that needs to be filed, cataloged, and used keeps growing exponentially. That hasn’t changed. One customer started with a license that was in the range of $40,000 and has now signed an EAA for in excess of $10 million. It seems Whatever Splunk paid to onboard that customer was really worth the cost. The cost of selling became negligible.
Gartner says the the amount of data generated will double every two years. There are very few areas in enterprise software that have such a powerful demand engine undergirding growth.
It is important to understand what Splunk does that is different from the stack vendors. First of all, Splunk is data source neutral. It doesn’t matter whose software the data is coming from.
But, of course, the biggest issue is one of speed. The stack vendors are simply not set up to index data nearly as fast. Splunk spends a huge proportion of revenues on R&D. What it has gained is technology that dramatically reduces the number of filers necessary to index the transactions. On the call, management spoke to reducing the required number of filers by 60% in two years. Other vendors simply haven’t tried to spend the money necessary to create solutions that do what Splunk and its far smaller peers are trying to do.
When it first started, I wondered how it would do a job better that others who had been at it for a decade or more. But it is quite evident that Splunk has simply been eating the lunch of the BI vendors in the data indexing space, and more and more users are realizing that they ought to be indexing and analyzing all of their data.
Splunk does not have the competitors that you’d expect.
The market continues to expand at breakneck speed, and
The torrent of data is rising rapidly.
But don’t Tableau and Qlik also play in the Big Data space?
Think of it this way. Tableau and Qlik want to put their software on every desktop. Splunk wants all of the data of an organization to be processed by its (Splunk’s) software. They aren’t analogous. The goal of both the companies is to develop apps that allow desktop users to visualize the data and to create usable graphs and charts of various kinds to visually represent data as part of decision support systems. The software that Tableau and Qlik sell is not designed to index data, it isn’t designed to ensure that the data being charted comes from pure sources, and that threats to the data have been statistically analyzed. The issue really is that while Tableau and Qlik are focused on visualization on the desktop as a core strength, Splunk’s core competency is in data analytics and data security. There isn’t a one-for-one match.
For Qlik and Tableau to grow, they have to sell more and more seats. To me, trying to get more and more users within an organization to be able to visualize data is really counter-intuitive. I do not think it is necessary or even desirable for every knowledge worker in an organization to deal with data visualization. It is far better left to data analysts and professionals than being “democratized.”
For Splunk to grow, the enterprise has to use more data. No one cares how many desktops use the software, pricing is based on how much data is indexed per day. It is simply far, far, more simple to tell a user that the volume of data flowing through the Splunk indexers has doubled or trebled or, and that it is time to get a new license.
At this point, 70% of Splunk’s revenues are coming from existing customers who are developing more use cases and processing more data. The customers themselves do the selling. I do not think something like that will ever happen in the market for data visualization tools. If Splunk never sold another new account, it would continue to grow for some years, and it would be far more profitable. If either Qlik or Tableau stopped selling, they would destroy their financial models, within a brief span.That’s why Splunk is far less likely to blow up than these “competitors”.
How does Splunk compete with its rivals, and why will it continue to maintain competitive advantages?
I think Splunk is a company that really lacks direct competition from the larger software vendors. It maintains it has an 85% win rate, and they feel that an 85% win rate is a sign that they are simply not engaged with all of the potential customers who could use its product.
Splunk actually partners with many of the companies that you might think of as potential competitors. For example, at this time, Amazon is probably its most important partner, and it has strategic relationships with both Cisco and EMC. All of those companies might be thought of as potential competitors, but they are partners instead, and real partners in the sense that the Splunk solutions are part of solutions sold by those companies, whose salesmen get both quota credit and normal commissions for selling Splunk’s solutions. Splunk does face competitors, but most of them are companies you have never heard of before and are unlikely to hear of in the future.
Even large companies have limitations on all of the development projects they can undertake. I think it is relatively obvious that the priorities of large competitors these days is to improve their cloud offerings and not to worry so much about adjacent markets. The major takeaway in considering competitors is that, for a variety of reasons, none of them is likely to derail Splunk’s overall strategy anytime soon.
But isn’t Splunk still expensive, and why does it have such a minimal level of even non-GAAP profitability?
It doesn’t enjoy the specific benefits that I see in subscription models that generate lots of cash and lots of recurring revenues. It has offered a cloud alternative to its on-premise software for a couple of years, and it partners with AWS and others, where it provides its partners with tools that users want. But so far, the major revenue stream is license revenue, which made for 61% of total revenues last year. The percentages are changing, but not precipitously. In the prior year, it got 63% of its revenues from licenses. We really don’t know precisely the percent of cloud revenues, and it is certainly less than half the revenues not coming from licenses, as services still makes up the preponderant share.
Splunk is growing its top line rapidly, and it has lots of momentum. But other companies in other spaces are growing rapidly as well. I think the underappreciated and not-so-secret sauce in its business model is its ratable model (proportionate to usage). Last quarter, 53% of its deals were done on its ratable model. Splunk has a variety of ratable options, but the standard contract allows users to designate sources from which data can come, and then indexes the data so it can be analyzed. A typical Enterprise license will specify how much data a user can index per calendar day. Enterprise licenses are standard software on-premise licenses modified to provide for a fixed level of indexing volume. If more data goes through the indexers, the user has to pay tiered fees.
Given the growth in the volume of data generated by most enterprises, it is almost inevitable that users wind up paying significant overage fees at some point during the course of their agreements. Not all customers pay overage fees, of course, as they may have purchased adequate capacity initially, or more likely they have been pushed into EAAs. And we don’t know the volume of overage fees, but we know it is substantial. For example, a customer who wasn’t yet consuming the maximum data-throughput actually came back to re-up a year early, and significantly upped their data levels, leading to a very large sale that was unexpected by the sales people.
The growth in data volumes is basically a force of nature at this point, and investing in Splunk will certainly provide investors with the most direct correlation to the rapid rise in aggregate data volumes.
One thing that the ratable model does is to delay the timing of some revenues. When users elect to buy more data throughput than they actually use, Splunk does not account for all the revenue immediately, even if it is billed and paid for. While it has nothing like the deferred revenue balances that subscription vendors have, it has seen some increase in deferred revenues that are in in operating cash flow.
Splunk’s EAAs are very tiered, and the company has reduced the entry level into the new tiers to accelerate the adoption of its software into more use cases. As a result, it is even hard to hazard a guess as to how valuable new customers are going to be. With Splunk, almost all of its customers are going to consume more data over time than they signed up for. They will either start paying substantial overage fees or renegotiate their license to allow them to consume more data. It is the extremely rapid growth in revenues per customer over time, that has led Splunk to spend so much of its money on sales and marketing. If one looks at sales and marketing on a static basis, the 82% expense ratio is extraordinarily high. But if one looks at the revenue dynamics engendered through customer acquisition, investors would actually want Splunk to spend more on S&M than it does, since it will generate so much additional revenues from the new customers that it captures. It is this phenomena that makes the shares look like a bargain.
Obviously, the people who run Splunk are not unmindful of these concerns. There are some signs that the company is beginning to rein in the growth of its S&M expense growth, although, admittedly, not much. It will be a balancing act between growing the user base to take advantage of the overage fees and in improving profitability.
Management guidance for the current year is for 32% overall revenue growth, and while that rate was a significant increase in guidance at the time it was given, it means growth in the current fiscal year is to adj operating margins in the current year of 5%, up from 3.8% in the prior year. But this will never be a margin story until it ceases to be a hyper-growth story. The plan is to increase operating margins by about 1-2 percentages points per year. That is even a bit better than it sounds, as it will gradually be getting a higher proportion of its revenues from subscriptions, which will depress short-term revenues and margins.
Stock-based comp is not a minor item. Stock-based comp was $283 million last year, which was over 40% of revenues. At least that was down a bit from the 47% that was recorded for fiscal 2015. I imagine that over time, the company will continue to reduce its stock-based comp as a percentage of total revenues, but it would be foolhardy indeed to expect such expenses to be less than 20% of revenues for the foreseeable future.
Splunk’s other operating expenses are far greater than one might expect. G&A is 18% of revenues. That is at least 50% above what would be considered normal for its size. R&D is an extraordinary 32% of revenues. Most software companies spend half of that or less. So, there is really loads of operating leverage lying in plain view at Splunk. It is really a question of when and at what rate it chooses to pull the profitability levers.
Splunk is starting to generate a significant level of cash flow. For the year, they generated $156 million in operating cash flow, up 51% from the prior year. Most of the cash flow is coming from a significant increase in the deferred revenue balance, up 48%, reflecting both the nascent cloud revenue stream, and more deferred revenues coming from EAAs, where some of the revenue is deferred until the customers fully utilize the capacity that they have bought.
The company’s free cash flow was $104 million last year. Free cash flow was depressed last year due to one-time capex facility purchases, including their SF headquarters. It will be similarly depressed in the current year because of the build-out of their Silicon Valley campus. Normalized expenses for capex are unlikely to exceed $20 million/year after this year for the foreseeable future.
Splunk has a lengthy record of beating and raising estimates, and I believe it will continue to do so. Overall top line growth should continue to exceed 30%, absent any pronounced swing to cloud deployments. There is so much potential leverage in the business model that, at least for the next few years, EPS will be more a matter of company choice than anything else. Splunk is forecasting adj EPS of 28 cents this year, and that is up 25% since before the earnings release last month. I would be surprised if the real numbers weren’t significantly greater, although they will not enough to make this any kind of a value stock.
Some final thoughts
How much do you value a company with a unique business model that is growing at 30%+ and ought to be able to continue to do so for at least another several years? How much is the built-in future revenue from overage fees worth to an investor? How much is their potentially enormous operating leverage worth to investors? And to what extent should the shares be penalized for its excessive use of stock-based comp?
Some are going to look at the level of stock-based comp and be completely turned off. Others are going to be really enamored with the huge future revenue potential. And some are going to wonder how long Splunk can exist in a hot market without attracting far more formidable competitors.
It spends an extraordinary amount on compensation, even by the standards of a software company. A rough estimate is that it spent over $400,000 per employee last year. That is probably 1/3rd higher than typical employment costs go at software companies. Most of that extra amount is stock-based compensation. I think the combination of more profit-focused financial management, coupled with a rising proportion of revenues coming from overage payments will change that over time.
I am not suggesting that Splunk shares are cheap. But they are significantly cheaper than they have ever been since they went public, and the outlook for what they do has more promise than it ever has. The shares are quite volatile, and they aren’t defensive. But, in my opinion, Splunk is the best way to play the continued data explosion that seemingly has no end point in sight. Disclosure: I have no plans to initiate any positions within the next 72 hours.
Aug 2016 – Bert’s Take after earnings
Splunk beat revenue and EPS estimates.
The shares dropped 10% because it didn’t raise Q3 guidance above consensus (it did raise full-year guidance) due to more ratable bookings. There were a couple of downgrades by some less observant analysts.
It almost certainly significantly beat its bookings target for the quarter.
It has developed a wide range of use cases that immunize its results from the possible slowdown in spending for IT enterprise security.
How was Splunk’s Q2? - Well, it was really quite good, although some didn’t understand the vagaries of accounting and revenue reporting that were hallmarks of the quarter. I initially wrote about Splunk in March. The stock price was $47 and they got to $65+ before the earnings fall. The shares are labile. That being said, they have appreciated 29% in the past 5 months even after the sharp pullback. I’m writing another article because of the pullback that appears to be due to a totally misunderstood quarter. In point of fact, the growth of the company’s business has actually increased noticeably since my initial article, to where it is actually a better value now than it was then.
Revenues were up by 43% and they actually made a little money non-GAAP and generated a bit of free cash flow, although all of that is a product of stock-based comp. The growth in license revenues was 32%, which was clearly considered by some as a kind of a speed bump. The realities are that it was anything but that, but it was the cause of the share price reaction - and so far as it goes, the opportunity for investors.
The earnings actually were an upside - although at these levels, that is not the most important consideration. Revenues increased by 13% sequentially, which is probably not the shabbiest of results, especially as they beat the top end of the prior revenue forecast by 5%. They increased the number of new customer signings by more than 10% from Q1 to Q2. License revenues increased by 15% sequentially and services revenues increased by 14% sequentially.
Gross margins fell from 83% to 69%, although that wasn’t really a function of any pricing or expense pressures, as I will discuss below. R&D expense was flat at 31% compared to 32%. Sales and marketing came in at 70% compared to 76% in the year earlier quarter. General and administrative dropped from 20% of revenues to 16% year on year. Stock-based compensation increased by 39% year on year and increased by 5% sequentially. At least a bit of relative progress.
It is building a rather costly South Bay campus. Although they haven’t told us the exact cost of the building, it would appear to be in the range of $30-35 million
So where do people think there is a problem?
They provided guidance for next quarter of $229 million of revenue, with a non-GAAP operating margin of 5-6%. Basically, these estimates were unchanged. Investors have been habituated to quarterly beats and raises, and this was not that. They did raise guidance for the full year that will end on January 31, 2017, by about $18 million - 2% more or less, about half of it relating to the Q2 beat and the other half because of more rapid growth.
Splunk is a hybrid company in the sense that it offers both on-premises and cloud product models. It is really not feasible for any company to forecast the rate of its cloud transition on a quarterly basis - I defy any company to have an unbroken string of successful forecasts of cloud/on-prem mix. And Q2 was a quarter in which the cloud proportion of orders significantly exceeded the prior forecast. Cloud bookings were double the level that had been expected. Since what had been expected was pretty healthy growth to start with, the actual result was in excess of 150% growth.
Splunk has been assiduous in developing relationships with the three major cloud suppliers, i.e., Amazon, Microsoft, and Alphabet, in terms of integrating with their cloud offerings. Given the enormous growth of cloud deployments at all of those 3 companies, it is not particularly surprising that more of Splunk’s deployments are choosing ratable deployments. It has forecast lower percentages of ratable bookings in 2H than it has just reported; to a certain extent, the integration this company has with the large cloud suppliers may militate against that forecast. I really don’t have that quality of crystal ball.
Cloud bookings do a few things, none of them unique to Splunk. The revenues from cloud bookings flow into services and not license. The revenues that flow into services are far less than the revenues that would have flowed into license, and the change in the mix from license that has mid-90%'s gross margins to services that has gross margins of around 80% puts pressure on gross margins. As I have written many times, in the long term, cloud bookings will produce more revenue and more margin than a comparable level of on-prem bookings, but the crossover point is 3-4 years, after which the headline numbers will show material improvement.
Splunk just started offering a cloud version of its solution 2.5 years ago. If it were actually to show the kind of cloud bookings growth it showed last quarter, it would almost inevitably take at least another several years before the crossover point became visible - but I doubt the results of Q2 can ever again be repeated. (Honestly folks, the quarter wasn’t just good - it was spectacularly good, despite what the share price might be saying).
Depending on one’s point of view, it is surprising, disappointing or a significant opportunity to see analysts who do not understand the difference between on-prem and subscription billings or just how much more a cloud booking is worth than an on-prem booking. And to the extent that other observers are confused about the inevitable result on gross margins due to a swing from on-prem to subscription, it’s is an even greater opportunity.
As long as other investors misapprehend that very basic fact, there are great opportunities to trade against that misapprehension. Just how substantial is the misapprehension?
It is pretty standard for a perpetual license to cost about 3X-3.5X the cost of a single-year subscription. The perpetual license usually carries a 20% maintenance charge. Much of the time, users elect to buy subscriptions one year at a time. Sometimes the users will pay for several years in advance to secure a fixed (discounted) price. But often, users only pay once a year.
Splunk, for many reasons, doesn’t quantify bookings. That is unfortunate, but not new for them. But 4 of the company’s 10 largest transactions were based on subscription terms. All of those transactions were greater than $1 million. The math is such that just those 4 transactions would have subtracted $12 million from on-premise license revenues in this last quarter. I think if analysts had seen that $12 million in the headlines, the share price reaction, and frankly the questions on the call, would have been far different.
We would have to know the average length of the signed subscription contracts as well as their value to calculate just how strong the quarter was for Splunk - but the fact is that subscription bookings were double expectations and were 47% of the value of transactions. It might be noted that this was the second quarter in the fiscal year in which their subscription business more than doubled.
Cloud revenue, as opposed to cloud bookings, has a way to go before it will be separately disclosed. It will need to be more than 10% of reported revenues, and that probably will not be seen until later this year or in the next fiscal year. The CEO said he was not completely pleased by the percentage of business that is coming from Enterprise Adoption Agreements (EAA). But that has more to do with sales management than sales generation.
Far from derailing, this train is traveling safely and at very high speed, and the speed was as high or higher than it has ever been in Q2.
Why are some of the other security vendors are seeing far more difficult comparison?
I think it is far harder to provide a great answer to that question. A user swing to understanding broad-based security analytics is important. One thing to note is that Splunk is rated the leading vendor in what is called the Security Information and Event Management (SIEM) space. So, part of the reason is probably competitive. Splunk does security analytics better than its competitors, and that seems to be what customers are looking to have these days. It has had a fair amount of success with using the analytics as part of a fraud and risk management solution, even though the products it sells are not really labeled to do that. It has actually been labeled the best fraud protection product for two years running without having a specifically labeled fraud protection product.
Another factor is that the average Splunk customer has 168 independent products, and the ability of the Splunk solution to provide seamless insight in what’s happening across that landscape has been a demand driver as well.
It is worth noting that while most investors tend to lump Splunk in with all of the other vendors of IT security solutions, users look at the log data for other purposes besides just security. Without going through all of the use cases customers actually look for, less than 50% is for security. Some common use cases relate to looking at host details and comparing hosts in terms of their efficiency. Many users essentially use Splunk to proactively detect performance issues and take proactive steps to prevent those issues from impacting end users.
Overall, Splunk gives IT admins insight into the performance of their networks. Cybersecurity threat management is a relatively newish application. There are many applications that are built on top of the data that one can derive from the Splunk engine, and they do lots of different things. But optimizing IT ops is probably one of the primary demand drivers, and Splunk’s engine does that as well as anything else that is apparently on the market. In all, what is important is that the correlation between Splunk’s revenue growth and the growth of overall IT security spending is nowhere as close as might be thought, and the fact that some IT security vendors have had disappointing quarters hasn’t impacted Splunk’s business, and is unlikely to do so in the near future.
I might say that Splunk takes care of requirements that have existed for a very long time in a totally new way, and users apparently feel these new ways of identifying cybersecurity threats are more valuable or better address compliance issues than the traditional firewall solutions. But I think it is a mistake to try to assign any one demand driver to the success it is enjoying.
It has a significant level of sales momentum that grew in Q2, that its pipeline is strong, that its Q2 linearity was a bit better than normal and that its competitive position remains at the absolute top of the heap. Users like the value they get from Splunk, and if that value isn’t quite security or any other single category, there isn’t any issue with demand.