Looks like a beat on the bottom and top lines and raised guidance for the third quarter and year.
Revenue growth was 33% yoy overall with 80% growth in cloud revenues.
And they announced the acquisition of cloud monitoring company, SignalFX.
The stock was up 8.5% at one point after hours.
https://marketrealist.com/2019/08/splk-stock-rises-earnings-…
I hope this bodes well for Elastic too.
Dave
Long SPLK, Long ESTC
It’s trading down about 5%. Maybe the market wanted more. I don’t see any negatives so I added a small amount
I too was trying to figure out why SPLK was up 8% and then ended up at up .5% after hours. And now down 7% today.
The back half of the call was a disaster. The analysts were asking some tough questions and management didn’t have good answers. Only read it but it seemed like it sounded flustered.
As predicted pricing shift is upon them. They are just introducing unlimited plans of which they have “very few customers”. Management themselves admitted that customers are “frustrated” over Splunk’s pricing model. And upgrading to or close to unlimited is wieldly and expensive apparently.
Sharp decline in RPO bookings to 19%. Though adjusts to 23% when adjusting last year to current accounting. Which management says “is still not a sterling number”. This metric grew at 33% last quarter and >40% every quarter last year.
Swung from a cash flow forecast of plus $250M to minus $300M. Over a half billion swing to negative?
And what of Elastic?
Andrew Nowinski
All right. Thank you. And then, I was just wondering if you could comment on the competitive landscape specifically against Elastic and perhaps how your new pricing models have impacted your win rates? Thank you.
Doug Merritt
Yes. I think we’ve been pretty consistent in reporting what our win rates look like against Elastic and they remain very high. I’ve said over and over that one of the things that makes me excited, but also give me a pause for concern is when your average win rates against competitors are north of 80%, that means you’re just not being exposed to all the opportunities that are out there. I think that one of the things that’s holding us back, is people are really afraid about the price of Splunk.
It’s not so much the price, they’re worried about this data-driven metric. Because, again, I’ve yet to meet with a customer that says, I am not getting a fair exchange of value for the dollars I’m shipping you or euros or whatever the heck the quantity is.
They’re saying, I don’t like the fact that I feel out of the control, because we all know, the data volumes are going to go up. So I would anticipate and hope that this will continue to substantiate or accelerate those win rates. The win rates that I see are super consistent.
Win rate against Elastic “very high” and average against all competitors “north of 80%”. So against Elastic between “very high” and 80% or they would have said so. But CEO has “pause for concern” because they may be mostly dealing with customers who were already inclined to go with Splunk. So the win rate is potentially useless info.
That reply is worded to me like there’s blood in the water. Maybe not totally from competition, Elastic SEIM targeted end to end product in beta for about a month, though the stack has been developed to SEIM use case for some time. But management didn’t really say they are so much better that competition is not an issue either, like you get with our other companies.
The biggest culprit for their woes is their pricing model, which I believe is an existential threat to Splunk unto itself. Formatted for a gigabyte world in what is now a petabyte world and growing exponentially to the next byte level. Business model transitions create pain points. Always. Splunk and their customers sense this as do the analysts.
And disruptive companies like Elastic.
Splunk is a great company with a great product. They are far bigger than a company like Elastic and still putting up big growth numbers. In my opinion, from the way the call went, they have some trouble on the horizon. It’s not good to have your customers afraid of your pricing and feeling out of control.
Darth
Long ESTC
Thanks for listening to the CC and providing your insights.
The biggest culprit for their woes is their pricing model, which I believe is an existential threat to Splunk unto itself. Formatted for a gigabyte world in what is now a petabyte world and growing exponentially to the next byte level. Business model transitions create pain points. Always. Splunk and their customers sense this as do the analysts.
Even if its not an existential threat, it likely will weigh on the stock for some time.
And disruptive companies like Elastic.
Yes, it may not be an immediate threat but may be over time, especially if Splunk hits a bump in the road with its pricing model.
There are another couple potential negatives:
A downgrade to neutral by Baird citing cash flow uncertainty-
https://thefly.com/landingPageNews.php?id=2954164&headli…
And there may be some skepticism regarding the acquisition. SPLK paid twice the private valuation in June. The acquisition will also be modestly dilutive and significantly reduce its cash position.
Splunk is a great company with a great product. They are far bigger than a company like Elastic and still putting up big growth numbers. In my opinion, from the way the call went, they have some trouble on the horizon. It’s not good to have your customers afraid of your pricing and feeling out of control.
Yes, I’m not sure of my next move with SPLK. It may still be good longer term. It’s not a huge position but I probably should have waited for the dust to clear before adding more. ESTC might be the better bet.
Dave
I didn’t think the call was that bad, and not worth a 10% stock haircut. Management is aware of the customers concerns over pricing and are testing out different models where customers can push through unlimited data. So far those tests seem to be a hit with one customer tripling the amount of data.
I think management knows that the more data flowing through their systems the better and they’ll be rolling out the unlimited data to more and more customers. The question is what will the pricing look like? I imagine they’ll price it so that most of their customers pay a similar amount to what they’re currently paying but until they announce something we’re just speculating.
It’s also possible that they introduce an unlimited plan while keeping a plan that charges by the GB so they segment the market.
I’m remaining long splk and am considering increasing my position on this pullback.
It’s not good to have your customers afraid of your pricing and feeling out of control.
5 years and 3 companies ago we looked hard at Splunk and chose Elastic primarily due to Splunk’s volume-based pricing.
My current team is now looking at Splunk, but thinking about using Alteryx as a pre-filter to reduce the amount of data fed into Splunk. Splunk really is a better solution for us now than Elastic, but the pricing model is death.
For instance, here’s pricing of Splunk Enterprise: https://www.splunk.com/en_us/software/pricing/faqs.html#Splu…
Yes, the price per GB goes down as you purchase more. But, you have to do the multiplication, which their chart doesn’t show. So for 1GB/day you pay $150 per GB per month. And for 100GB/pay you pay $50 per GB per month, which equates to $5,000 per month! Perpetual license for the 100GB/day runs a cool $1.5 Million - and you still have to buy support every year to keep that active!
Now, apparently Splunk is stopping perpetual licensing and only doing term licensing.
And, note that these are max limits. It’s not pooled per month or anything. If you go over you get warnings, and then either get cut off or you get a bill.
Oh, and this is hosting Splunk yourself. If you want to use the SaaS/Cloud version, that costs you more. Interactive tool here: https://www.splunk.com/en_us/products/pricing/calculator.htm…
Now, to be fair, this is the cost for indexing the data. Once it’s indexed you can run as many queries on it as you want for no additional cost. But, to give you an idea of how much data companies have, consider that the free version lets you run 1/2GB/day forever.
For Splunk’s traditional use case - looking at server logs, this pricing really is death since you have lots of new data every hour and don’t care about data older than a few months. For other uses, like my team’s IoT data, it isn’t quite as bad since we care about old data very much.
Splunk doesn’t seem to understand that changing their pricing will result in LOTS more companies using their product, and should easily more than compensate for the lower profit per customer. That they understand their pricing is hurting them is a good first step, but it’s been going on for close to half a decade at least, so I guess I’m not optimistic that a change is coming soon.
One guess would be that an announced change in pricing would give a nice bump to the stock. That’s not something on which I’m ready to bet on at this point in time.
Splunk really is a better solution for us now than Elastic, but the pricing model is death.
I know it is just one company example, but can you elaborate on this point?
Is it more about features absent in estc or that price being equal the splk features are better?
And as users is part of it the extra work as a developer to use estc?
Thanks for the detail on splk.
Dreamer
I know it is just one company example, but can you elaborate on this point?
Is it more about features absent in estc or that price being equal the splk features are better?
For us, it came down to:
• In Elastic we had to define each field in advance during upload while Splunk is just a simple upload.
• With Splunk, our users can do dynamic data discovery/analysis/exploration. This is what Splunk does best. Chart X against Y. See a trend or a blip. Chart Z against Y. Or, find nodes where X and Z are both maxed out/correlated to each other and then deep dive into those few nodes.
• Our developers like Splunk’s query language better. The output of one query can be piped into another query, so you can build up analyses from building blocks.
ª The output of Kibana wasn’t as rich graphically as we got from Splunk, and the interactive nature of Splunk’s output generation was really the main differentiator for us.
• Now, this may be old. When I last looked, the Elastic Stack (ELK then) was a collection of separate tools (Elasticsearch, Logstash and Kibana). It appears that Elastic has put a bunch of effort into improving them, and just this year released some new UI for Kibana. So, it’s possible that my current team may make a different choice, but their thinking going in is to use Splunk.
Finally, remember, that Splunk started as a way to make sense of the ton of data coming from server logs. If you have a cluster of servers (dozens or hundreds) and something goes wrong you don’t want to have to look at each server’s log independently. Splunk was originally made to suck in all the logs and then help you find which nodes were not performing well, and then determining why. My IoT use cases are quite a bit different - we have orders of magnitude more nodes, but orders of magnitude less data from each node.
Thanks for that info Smorg.
Very interesting. I wonder what Elastic’s new SIEM app and Kibana enhancer Canvas have added to these types of decisions. Plus some of the Beats for the IoT ingestion. Among other newer features for Elastic.
I know for instance the SIEM app (which is just now part of the basic subscription to Elastic) has a custom UI and pre built but customizable dashboard for Kibana.
A battle is brewing in the log analytics space. That we can be sure of.
Splunk was originally made to suck in all the logs and then help you find which nodes were not performing well, and then determining why. My IoT use cases are quite a bit different - we have orders of magnitude more nodes, but orders of magnitude less data from each node.
I dont want to put words in your mouth…but are you saying splunk isnt a fit for IoT then? If not…what does seem a better fit?
Just recently posted this…IoT has become a real interest for me…but clear cut stock winners for that space seems tbd;
https://discussion.fool.com/nerd-alert-the-edge-34278782.aspx
Appreciate the responses!
Dreamer
I dont want to put words in your mouth…but are you saying splunk isnt a fit for IoT then?
Not at all - it’s currently the leading contender in our evaluations. There is a difference between fewer nodes with data versus lots of nodes with less data, and that’s all I was pointing out. So far I don’t see anything in Splunk that’s adversely affected by having lots of nodes. That could change, but so far it’s fine.
As for your referenced post, I didn’t read it in depth, but a general comment is that I’ve seen the computing industry move from central to edge to distributed and between and back and forth many times. With J2EE, applications moved to servers, which lead to “the cloud,” but as your typical phone now has an amazing ARM processor some things have moved back to the edge.
With processing on the edge, you don’t have the latency issues of transferring data up to the cloud and back. With processing on the edge, you can also retain your user’s privacy. For instance, Apple does facial recognition on the phone - your facial data is not sent up to Apple’s cloud and they really don’t know what you look like. Same for Apple Maps - if you don’t elect to use iCloud your Favorite locations remain solely on your device and Apple doesn’t know what they are. In addition, Apple divides your request into scrambled sections so that Apple doesn’t even know the whole route. Compare this to Google, in which your saved places are automatically synced from their cloud and routes are built entirely in the cloud and then downloaded to your device. (https://www.idownloadblog.com/2019/03/13/apple-maps-navigati… )
Anyway, I think things have/will settle into a hybrid model, where the cloud is used for global data access and where large, up to the minute data is needed. So, a POI search is best done on the cloud since you’re not going to want to keep 100’s of GB of POI data on your phone AND keep it regularly updated. Or, take traffic data, which changes by the second. But, there’s no reason to not do most computing on the edge, using data on/from the server.
Back to IoT, everyone’s in this space, from general purpose tools provided by Amazon (https://aws.amazon.com/iot/ ) or Azure (https://azure.microsoft.com/en-us/overview/iot/ ), to specific solutions provided (with consulting and engineering charges) by the likes of Harman (https://services.harman.com/solutions/internet-of-things ).
Some IoT devices will have lots of CPU and memory (automobiles), others will have tiny amounts (wearables, thermostats, etc.), so the solution set is going to remain big and diversified. Also, in some cases you want the data to be sent to a central server, if only to enable learnings from all the data (think autonomous driving learning), while in other cases the data can be processed on local servers (like looking at all the thermostats in your home to decide when to turn the A/C on). Again, latency, transmission costs, and privacy concerns will vary based on the application.
OK, I’ve rambled way too much here. I don’t see single winners in the IoT space now. Maybe that’ll change if someone does an open toolkit that just kicks butt and so is leveraged by all the student projects, but that seems unlikely at this point in time.
Compare this to Google, in which your saved places are automatically synced from their cloud and routes are built entirely in the cloud and then downloaded to your device.
But, by the same token, if you explore a route on your PC and then proceed to go there with your phone, the phone knows about the location to which you are headed.
I’m not optimistic that a change is coming soon.
We have a great historical example of the consequences of being too slow to change the licensing model. It’s IBM and their OS/390 - z/OS computer platform.
The primary licensing metric has always been MIPS (millions of instructions per second) or a derivative of MIPS, MSU (million service units).
These measurements reflect the amount of computing power a machine has. The more power, the higher the number and price of the software for the operating system, applications and utilities used on the platform.
The first OS/390 computers were rated at just a few MIPS, perhaps 10 or so (I cannot remember specifically, but it was low). Today, the computers are rated with tens of thousands of MIPS.
In a nutshell, here is what happened:
The required annual MIPS growth to run the required workloads has compounded >30% annually and purchasing managers underestimated their growth rates by about 25%.
Things were okay up until 2000 when locked-in IBM shops had no choice and had to buy in preparation for Y2K. Even by then, the various Unix platforms were on their way to taking over many of the mission critical workloads, primarily due to price advantages of the platform.
By then, IBM had a large pricing organization whose main goal, in my opinion, was to squeeze as much out of the customer as possible.
The large team was necessary, because the company’s structure and business model was dependent upon the profitability of the OS/390 business. The longer the pricing stayed based on MIPS growth the harder it was to shift away from it. Entire organizations were compensated based upon this model, which led to bad decisions and behavior. It was virtually impossible for anybody to come in and change how things were done.
Although this once ubiquitous computing platform is still important today, it lost its dominance to other platforms with better pricing.
Splunk will probably find itself having to create ways to keep the good times rolling without putting a big dent in its business. It’s likely that they are not well prepared to make a shift to the new realities of the industry. If everybody is dependent upon the growth model to earn a living, they’ll keep it until they cannot.
So it’s possible to see sales people as the first ones to feel the pain, because they’ll get a lot of pushback when they do deals, leading them to missing their numbers and then jumping ship. Then the business will have to start cutting down marketing and then development while sales cycles get longer and more difficult. The’ll have to start negotiating terms and conditions on a lot more contracts, consuming a lot mir time and energy for each dollar of revenue.
Highly negotiated contracts (especially perpetual license contracts) lead to interpretation issues on the next deal and cause even bigger relationship problems.
Hopefully, their management team could avoid this. But I’m not so sure they can turn the ship so easily at this time.
The SaaS model removes a lot of this, and I’m glad we have it in our companies now.
DJ
I can give an “in the field” confirmation that Splunk is experience significant pricing pressure and pushback from their customer base. I work in the enterprise security field and have recently had several new opportunities to displace Splunk open up strictly based on the customer’s frustration with Splunk costs. It’s not trivial, they are cutting new PO’s to adjust for increased data ingestion sometimes quarterly and making decisions not to ingest certain logs because of cost (which limits security visibility).
The one positive in this I would give Splunk is I am not seeing significant frustration from the user base in the capabilities or functionality of the solution. The pricing pressure is real and is being driven by top management, but the users are happy.
nice to hear a view from the field, thanks!
Care to comment on what vendors are being looked at when displacing Splunk, and do you have an opinion on Elastic’s offerings and their adoption rates you may be seeing by clients?
Dreamer
Splunk being “far bigger” than Elastic depends on how you define the phrase into relevant context.
Far larger by revenues yes.
Larger by customer base yes.
Larger by market presence and consumer {enterprise} top of mind in regard to who do you turn to for a SIEM? No. I don’t think Splunk is dominant in this critical marketing context.
Why is Elastic stock behaving as it is - a laggard? I don’t know.
Elastic IPOED at $30 or so and more than doubled in its first day to $70 in Sept 2018. Now here we are at $80.
In the interim there was the October massacre, the December zombie panic from all the walking dead from the massacre still collapsing, and the early 2019 renaissance for the winners.
All along Mongo has been near its 52 week high. Elastic has risen faster than Mongo did and faster than many others but pestered out for what is now close to a year. That is a long time stock wise.
No point. Observation. It does seem as if Elastic has more going for it than this. You don’t have to look at relative valuation. It’s absolute valuation may become cheap this time next year if nothing changes.
That is what happened to two of its primary competitors New Relic in the APM field and Splunk in SIEM. New Relic is having real issues. Splunk is coming under distress. Is Elastic playing a role in this? Dunno. Do know Elastic wants to play in both markets where the current leaders are struggling and Elastic cannot really point to asserting disruptive dominance. Perhaps a holding pattern until this does or does not becomes apparent.
Risk/reward. But we also have to worry about fooling ourselves and pretending wishing it can do something is reality.
I don’t get the feeling Elastic is fooling themselves or us. So I don’t think that is in the way of proper risk/reward.
Ahhhh,mindless observations. Sometimes it just is because the world is not symmetrical or perfect. But jagged and imperfect causing things to finally happen in their own good time.
Tinker
“Care to comment on what vendors are being looked at when displacing Splunk, and do you have an opinion on Elastic’s offerings and their adoption rates you may be seeing by clients?”
Sorry been traveling and fell behind on… well everything.
Usual suspects as far as who folks are looking at to replace from the Magic Quadrant but I would say the most commonly mentioned in my limited sample size have been:
Exabeam
Elastic
IBM QRadar
Certainly bodes well for Elastic longer term. Exabeam is private. I’m invested in Elastic and feel good about it for the medium-long term. Short term never any clue!