Splunk Inc (SPLK) 2013 Q1 法說會逐字稿

Ladies and gentlemen. Good afternoon. At this time I would like to welcome everyone to Splunk's first-quarter 2013 earnings conference call. During the presentation, all participants will be in a listen-only mode. A question-and-answer session will follow the Company's formal remarks. (Operator Instructions). I will repeat these instructions after management completes their prepared remarks. Today's conference call is being recorded.

And now I will turn the call over to Ken Tinsley, Splunk's Corporate Treasurer and Director of Investor Relations. Please go ahead, sir.

Great, thank you, and good afternoon, everyone. With me on the call today are Splunk's CEO, Godfrey Sullivan, and CFO, Dave Conte.

As a reminder, today's conference call is being broadcast live via webcast. In addition, a replay of the call will be unavailable on our website following the call.

By now you should have received a copy of our press release that was distributed this afternoon. If you have not, it is available on the investor relations section of our website.

Before we begin, I would like to remind you that during today's call we will make forward-looking statements regarding future events and financial performance including our guidance for our fiscal second-quarter and full fiscal year 2013. We caution you that such statements reflect our best judgment based on factors currently known to us and that the actual events or results could differ materially.

Please refer to the documents we file from time to time with the SEC specifically our final prospectus for our initial public offering and our periodic Form 8-K filings including the Form 8-K filed today with our press release. Those documents contain and identify important risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements.

Forward-looking statements made during the call are being made as of today. If this call is replayed or reviewed after today the information presented during the call may not contain current or accurate information. Splunk disclaims any obligation to update or revise any forward-looking statements. We will provide guidance on today's call but will not provide any further guidance or updates on our performance during the quarter unless we do so in a public forum.

During the call we will also discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results is provided in today's press release and on the investor relations section of our website. The projections that we provide today exclude stock-based compensation expense which cannot be determined at this time and are therefore not reconciled in today's press release.

With that, let me turn it over to Godfrey.

Thank you, Ken. Welcome, everyone, and thank you for joining us our first-quarter 2013 earnings call. It's good to be speaking with you again following the IPO and we really appreciate your interest in Splunk.

The momentum we realized last year is continuing in fiscal 2013. Our first quarter revenue was $37.2 million representing 80% growth compared to the first quarter last year. We are also delighted to welcome over 350 new customers to the Splunk family and we now have over 4000 customers in 80 countries. Even with this level of new customer acquisition, many of our existing customers continue to expand Splunk usage across their organizations and in the quarter, they represented more than 70% of our business.

During this call, I would like to provide an update on several of our key themes. First, Splunk is an enterprise data platform, also Splunk has an engine for applications and developers, and finally, investing for growth. I will spend a few minutes on the first two topics and turn it over to Dave for the third.

So Splunk is an enterprise data platform. Splunk has a unique opportunity as an analytical engine for all kinds of machine data. Our ability to scale from a free download to an enterprise deployment gives us multiple drivers for growth. New customers tend to start with Splunk software for core IT troubleshooting and then discover the power of the data engine for additional use cases.

Of our 350 new customers in Q1, approximately two-thirds of those customers bought Splunk Enterprise primarily for application and operations management. Splunk enables users to gain real-time visibility, monitoring and analysis across their applications and underlying infrastructure. This includes all kinds of servers and network devices whether physical, virtual or in the cloud.

For example, Stanford University's network infrastructure needs to be reliable and available 24 by 7. Splunk Enterprise gives Stanford the real-time visibility they need to monitor, troubleshoot and report on the availability, reliability and security of the university's network.

Additional new customers during the quarter using Splunk for application or operations management include Evernote, McKesson Health Solutions, the Scottish Parliament, and the Australia Post.

We continue to see about one-fourth of our new customers making their first purchase of Splunk software for security use cases, to improve their security posture and to speed instant investigations. Many of these customers may already have a SIM and purchase Splunk because of our capabilities in identifying unknown security threats such as advanced persistent threats.

Splunk's ability to index machine data beyond traditional security silos enables us to provide additional value like uncovering complex fraud scenarios. For example, Hana Financial Group in Korea is a new Splunk customer and uses us as their solution for security monitoring as well as for forensic investigations. Information security is a major concern in Korea especially after a system-wide crash last month halted transactions at a major bank.

Security is increasingly a big data analytics problem, where it is essential to correlate transaction information not just traditional security information and this is where Splunk Enterprise excels. New customers during the quarter using Splunk software for security and compliance include NASA, Rolls-Royce, T-Systems and the University of Mississippi Medical Center.

While our new customers are often selecting Splunk to solve a specific problem, our existing customers often expand their use of Splunk Enterprise for new or adjacent uses. They learn from their data and by putting more data types into the Splunk index, they are able to gain new levels of insight.

Our existing customers grow with us in two ways, by purchasing more capacity for an index, what we call an upgrade, or by starting a new index in an adjacent department, what we call an expansion. Tesco, a UK-based retailer uses Splunk Enterprise to deliver a unified view across their infrastructure and in Q1, upgraded their capacity to support the hundreds of thousands of online orders they receive every week.

Splunk is used to trace transactions, monitor application performance and to gain valuable Web intelligence about their customer activities. This is a good example of a customer upgrading the capacity of their existing system.

An expansion example is CenturyLink, the third-largest telecom in the US. They initially deployed Splunk software for network troubleshooting and monitoring. In Q1, they expanded beyond IT to their business operations. This index includes monitoring and analyzing order processing, call-center traffic and their website orders.

In summary, we made good progress toward our long-term goal of Splunk as an enterprise data platform. We are happy about our new customer acquisitions and saw a lot of activity with customers upgrading or expanding their use of Splunk Enterprise.

Another of our important themes is Splunk as a platform for developers and an engine for applications. I'd like to update you on three areas of activity here, our dev tools our apps and a cloud initiative for developers.

First our dev tools. During Q1, our development team in Seattle shipped beta versions of our first two SDKs for Python and JavaScript. These SDKs are designed to make it easy for developers to create apps that run on top of Splunk Enterprise which will enable a new generation of apps that leverage the Splunk index but provide new types of use cases built from industry-standard code.

We also made good progress in Q1 with our Splunk apps. We delivered a major enhancement with the release of Enterprise Security Version 2.0. This release provides out-of-the-box security content to complement the flexibility of the core Splunk engine to do forensic search on new threats.

We also released a Splunk app for Microsoft Exchange. This app leverages the ability of core Splunk to collect index and correlate machine data from every part of the IT infrastructure and then the app provides context that is relevant for Microsoft exchange administrators. A major financial institution purchased Splunk in Q1 specifically to monitor their exchange infrastructure.

Virtualization is another notable market opportunity for Splunk. In Q1, one of our large transactions was Splunk Enterprise plus our app for Citrix XenDesktop, which gives VDI administrators a single pane of glass for analyzing, troubleshooting and real-time monitoring of their entire virtualization stack.

We also just released our Splunk app for VMware into beta. Some of you folks recently attended our SplunkLive! events in DC and Boston and you saw the high levels of customer interest in our upcoming VMware app.

Finally, our cloud initiative for developers. As more startups and developers move their projects to the clouds, we want to be there with them. Splunk Storm, our service running in the public cloud, provides developers with a scalable, pay-per-use version of our software. Initial user feedback has been really positive and Splunk Storm entered the public beta phase last week. We currently have hundreds of active beta users and expect to GA later this year.

In summary, we're making good progress in our theme of Splunk Enterprise as an engine for applications and developers. We delivered SDKs, we shipped several new apps and we are in beta with Splunk Storm. I'm very proud of our development team for their continued innovation and will continue to invest heavily in our product initiatives.

To support our expanding development organization, I'm delighted to welcome Guido Schroeder as SVP of Products. Guido joined us in Q1 and brings more than 20 years of enterprise software, big data and BI experience to Splunk; most recently 16 years at SAP.

Splunk cofounder Erik Swan has created the office of the CTO and is building a core team to focus on long-term technology strategy and evangelism.

And finally, I'd like to take a moment to highlight a few awards we received during the quarter. The SC Awards Europe named Splunk a best enterprise security solution. Splunk customer Crossroads HK, was honored with a Computerworld Laureate's award for their use of Splunk software and organizing volunteer resources during recent natural disasters. And for the fifth year in a row, Splunk was named one of best places to work by the San Francisco Business Times.

This award is a testament to our culture at Splunk. We believe investing in our people is a key to our growth. We're proud to have passed the 500 employee milestone this quarter and now have employees in 12 countries. I also want to thank our phenomenal customers and also our partners for their enthusiastic support of Splunk.

Thank you and over to Dave.

Thanks, Godfrey, and hello, everyone. First, I will provide a recap of our results for Q1, then share our outlook for Q2 and the full fiscal year. As Godfrey mentioned earlier, revenue in the first quarter totaled $37.2 million, an increase of 80% over Q1 of last year. License revenue in the quarter totaled $24.4 million, an increase of 68% over last year.

Professional services contribution was consistent with prior periods at approximately 7% of total Q1 revenue.

While we added more than 350 new customers in the quarter, our installed base continued to buy more Splunk software. Specifically, 74% of the quarter's license bookings came from our existing customer base and 26% came from new customers. Of the existing customer orders, about one-third came from their need for more capacity in existing use cases that is upgrades, and two-thirds from a expanding into new use cases for departments.

Additionally, we continue to see a high number of large transactions with 73 orders greater than $100,000 signed in the quarter, up from 46 greater than $100,000 transactions signed in Q1 of last year. The steady growth and large order volume is reflective of our continued investment in our direct sales force. Specifically, over the last several quarters, we have changed our sales team mix from being primarily an inside sales team to currently having direct reps represent approximately two-thirds of the 101 total quota carriers we had on board as of April 30. This compares with 94 total quota carriers on board as of January 31.

International expansion is another important growth initiative and we continue to invest in our global field organization. Since Q1 of last year, our international customer base has grown over 70% and now totals more than 1400 customers. At the same time, international continued to contribute a consistent amount of revenue and represented approximately 19% in Q1.

As international customers spend more time using our software, we expect they will follow the trend of our US customers who buy anywhere from two to three times more product in the two years following their initial purchase. As global customers mature, we expect our international business to grow to about one-third of our total revenue over time.

As it relates to existing customers, we calculate our maintenance renewal rates on a rolling 12-month basis and increased Q1's renewal rate to 88% from 84% in the prior quarter. Going forward, we expect that our ongoing maintenance renewal rate will range between 85% and 90%.

While we primarily sell perpetual licenses, we also enable customers to use our software on a term cases. Historically term-based transactions have represented anywhere from approximately 10% to 20% of any quarter's licensed bookings and were approximately 11% in Q1. We expect to see continued variability in the mix between term of perpetual licenses sold based on the customer buying preferences.

Turning to margin and profitability, overall gross margin was 89% in line with prior quarters. Gross margin on maintenance was 88% and professional services margin was about break even. As we continue to focus on customer success and expanding their use of the Splunk across their organizations, we will continue to increase our services capabilities. With that we expect to operate our services team at or near breakeven and will eventually expand service margins over time.

Non-GAAP operating margin which excludes $2.7 million of non-cash stock based compensation was a negative 9.5% for the quarter. Non-GAAP net loss was $3.7 million and excludes stock-based compensation charges and a non-cash, nonrecurring $14 million warrant related charge.

Net loss per share was $0.04 based on a total share count of approximately 94.6 million shares which assumes the IPO occurred at the beginning of the quarter. We've included a table in the press release that reconciles this number to the weighted average shares outstanding for the quarter.

Given our non-GAAP loss, the 94.6 million shares does not include the impact of common stock equivalents which consists of outstanding stock options.

On the balance sheet, we ended the quarter with about $266 million in cash which reflects approximately $227 million in net cash realized from the IPO. Cash flow from operations in Q1 was $11.6 million reflecting collections from our Q4 business. Ending accounts receivable was approximately $23.5 million and DSOs were 57 days. We experienced high collection activity in Q1 as reflected in our operating cash flow results and going forward, we expect DSOs to range between 60 and 75 days which is consistent with prior periods.

Derived bookings which we define as revenue plus the change in deferred revenue totaled $43.7 million in Q1, an increase of 88% over Q1 of last year. Now looking forward for Q2 which ends July 31, we expect total revenue of between $38 million and $40 million and non-GAAP operating margin of a negative 8% to 9%.

For the full fiscal year, we now expect total revenue of between $174 million and $177 million representing annual growth of around 45%. Consistent with our growth strategy, we will continue to invest aggressively in our product development and sales expansion initiatives to extend our leadership position and expect to do so with discipline and balance.

For the full year, we expect to increase overall spending while maintaining positive operating cash flow with an overall non-GAAP operating margin between a negative 4% and a negative 5%.

To summarize, Q1 was a good start to the year and we are pleased with our results. Having significantly added G&A and infrastructure to support our IPO and scalability, we will continue to focus on building our product development and field organizations going forward.

With that, we would like to turn it over to questions.

(Operator Instructions). Keith Weiss, Morgan Stanley.

Very nice quarter out of the gate. I wanted to ask a little bit about the investments you guys are making in the business. This quarter if I heard you right, it was 100 -- you ended up with 101 quota carrying sales reps, which I believe is up in the mid-30s on a year-over-year basis. Given that you have a targeted growth of 45% for the year, where would you expect that number to grow to throughout the year? I would assume that sales is one of the areas you are making a lot of investments. What kind of growth are you expecting in sales capacity for the year?

Keith, it's Dave, thanks for joining. We ended the quarter with about again with 101 quota carriers and when we think about adding capacity, which is the basis for our model, it's all in the context of what rate can we are effectively identify, recruit on board and get productive new resources.

A specific number isn't something that we are guiding to today but if you think about how expenses are reflected on the line items of the P&L with roughly 60% in the sales and marketing category, that is how we are thinking about the headcount investment for the balance of the year. Of course in the sales organization you will have non-core carriers such as SEs, management and technical and otherwise. So a percentage of that 60% growth will not be quota but that is the way we think about it.

Got it. And then on the broader macro, we are all obviously hypersensitive about Europe right now. What are you guys seeing from the overall macro environment right now particularly internationally but even in the US in terms of new customers looking to embark on new projects, if you will?

Yes, this is Godfrey. We may be too small at this stage to be a really good bellwether for macro trends. I think our biggest challenge is more around we are still in that evangelism stage of the marketplace and we have to go out and explain to people what we do and work ourselves into projects and then compete for budgets. So even in a static or a tight budget period, we feel like we can compete effectively for budget dollars. But I just think our bigger challenge right now is awareness and getting projects started with customers. Once they sign up and join use, we know that they will expand their use cases.

So for us it is more about the early-stage evangelism. So, sorry I don't -- I'm probably not the best bellwether for the macro situation.

If I could swap and have a different second question rather than a macro question which is inappropriate. Deals over $100,000 still growing really nicely on a year-over-year basis. Is that indicative also of where ASPs are trending? Or maybe the question is, is that starting to influence overall ASPs to start to trend higher? And how are ASPs looking in new customers versus the existing customers? Are those trending in-line or are there separate dynamics going on there?

Sure. I think that was actually multiple questions and your repeat second question so let me make sure I get to them all.

I'm not going to ask anything else.

That's okay. So the ASPs were actually pretty consistent just over $30,000 for the total population for the quarter. That has been our ASPs overall for I would say the last 2 1/2 plus years. Despite the growing number of large transactions and as you mentioned nice growth rate there, the number of non-large transactions has also continued to grow. So we see greater than $100,000 transactions anywhere from 5% to 6% of total license transactions in any quarter and that was consistent for Q1, hence the consistent overall ASPs.

Thank you, guys. Nice quarter.

Philip Winslow, Credit Suisse.

Great quarter. I just had a question to some of the sales force changes you made at the beginning of the year that you touched on. I wonder if you could just dig into sort of the strategy behind that? I'm assuming that some of that is to cross sell across the different stovepipes of these organizations to expand the use of the Splunk. And kind of is a derivative of that, how do you think that affects ASPs? And then kind of longer-term, how do you think about that affecting sort of the sales force productivity and the leverage you get out of the sales force versus the past? Thanks.

Thanks, Phil. This is Godfrey. So the place where we made the most sizable change in the quarter was in the Americas, Europe and Asia were fairly static with prior years. But in our most mature market or most market where we have the most critical mass really felt the need to start to align the field organization around our customers a little bit better. So we moved from a primarily geographic view to one that was tiered around named major accounts, sort of mid-enterprise territory management, and then SMB.

And so it was the first time we have really done a significant reorganization in our field organization and so we are still working through that but it is complete and now everyone is getting used to their new territories or their account assignments or that sort of thing.

So it was really a logical move. We are only in 50 of the Fortune 100 and only in something like 200 of the Fortune 500. So we have a long way to go in terms of just overall account penetration. As you said once we get in then we can start to cross sell and upsell in different departments and the like. But first we needed to get a tighter organizational alignment and account focus on the area of -- in the areas of just pure account penetration. It is probably still too early to give you trends on how it affects things like ASPs or account penetration strategies and success but our customer capture was good and our upsell and expansion sell was good. So, so far so good. We are pleased with the results so far.

Got it and I promise just one follow-up. But when you think about competition out there obviously your renewal rates trended better this quarter. You talked about big deals. I am just curious what you are seeing from the competition? Thanks.

So the competition continues to be on a market segment or solutions segment basis. So in the security market, very consistent competitive environment against prior periods. I would say that if there was any change, it's probably that we saw a few customers coming back from having gone off into a custom build project and coming back after year's worth of frustration and saying, okay, I'm ready to use Splunk and perhaps trying to build everything in some custom environment is not the best solution.

So we saw a little bit of that that helped us out in some of the larger transactions, but I think that was -- the rest of the competitive field was fairly consistent with prior periods.

Great, thanks, guys.

Brent Thill, UBS.

Thank you for taking the time. Godfrey, just on the product evolution, can you just help us walk through kind of the key milestones for the year, the things that you can talk about and how we should be expecting the rollout this year?

So without getting into a detailed roadmap discussion, I think I will just talk thematically about it and that is that we think of development in three core areas. And one is the platform itself, Splunk Enterprise, the other is in the world of apps and SDKs, and the third is in the cloud. So we will continue to push forward to improve the scalability, performance, user interface and all other features of Splunk Enterprise the way we do now. We've historically brought out a major release about once a year and I don't really see the cadence for that changing at the moment we still pushed hard to put new functionality in that product at all times. We're making great progress on the SDKs, the apps, solutions and the like, all of that is consolidated under Guido now and then whereas the apps piece of the business used to report directly to me. So that we have consolidated all of that under Guido. I think that is a really good move for us.

And then the third initiative is the cloud. And of course Splunk Storm just entered its beta phase so we have been in private beta up until now and we just entered public beta. We want to stay there for a few months and really understand scalability, performance, how many concurrent users, all of that sort of thing. And then we will move that out into GA later in the year. But very impressed by the progress of the development team overall and bullish on what we can do going forward.

Okay, and just a quick follow-up. Your pricing model is very unique relative to many of the vendors that we all follow on the call and that has been priced on the index that they are taking on. I guess from what you are hearing from your customers, is that something that they are still very comfortable as they are adding more and more data that they feel like that's the right model that they should be paying going forward or is there any changes in the pricing that we should expect to see in some of these new offerings?

If we had some other offering I am sure we would get constructive feedback about that. The benefit of user -- of the index pricing is we don't charge based on how many users they have, we don't charge based on how many geographies they are in, we don't charge based on how many servers they deploy. We just charge based on how much data that they index on an average daily basis. It's actually a pretty Democratic approach. We only charge for the data that is actually used not stored or any other things.

So in some ways I think it is one of the most fair pricing models that I have ever seen. As many of few you have heard from either SplunkLive! or customer meetings or your own IT departments, we get some resistance as the data volumes grow into really large levels about that. And so we tend to offer greater discounts, greater volume discounts as the data volumes expand to really high levels and that seems to work out pretty well. We will keep an eye on it but so far, so good.

Great, thanks. Congrats.

John DiFucci, JPMorgan.

I have a question for Godfrey and then a quick follow-up for Dave. Godfrey, just this first question is a follow-up to Phil's question on competition. And it sounds like you are still when you go to market you are still going out specifically after -- it's being applied to a certain specific use case or a certain specific solution or market. But have you started to see anyone really start to look at Splunk when they purchased Splunk and they are thinking of it as buying it as a platform to be able to use for several use cases or is that still to come? Are we early in that yet? Has that really started to take hold or where are we in that development?

Yes, we are still very early stage on that, John. Most of our 350 new customers that joined us in the quarter bought a relatively small license, a few exceptions. I believe out of our 70 plus six-figure transactions we had what, five or 10 that were brand new customers to the Company?

Oh, yes, yes.

I think it was more than 10.

Over 10% of the 73 transactions were new.

Yes. So we had a handful of customers that actually in their first purchase of Splunk now are buying six figures worth of product and that often reflects the fact that they see multiple use cases coming and want to buy enough indexing capacity. So that's -- we are making progress on that but I have to still say, our early customers tend to be smaller purchases and then the light goes on and they grow over time.

It is still surprising how many of our new customers coming on board are using Splunk instead of the old way of doing IT troubleshooting, which was basically manual, it is called [gripping] logs. These guys are -- they still see Splunk as just this marvelous -- this miracle that they can do in a couple of minutes what used to take them hours or days or never. So, no, I still think we are pretty early stage in terms of how customers enter their relationship with us.

Now that said, some of our larger customers are clearly getting that and buying in much bigger quantities because they see multiple use cases and multiple opportunities to get value out of it. So I couldn't be happier about it.

Okay, great, that is very helpful. And, Dave, as you noted, cash flow really strong, a lot stronger than we were looking for, anyway, $11.6 million. We were looking for flat to down a little bit, that's what we were modeling. And collections were strong. But this sort of demonstrates I think demonstrates the leverage of this model a lot earlier than we thought we would see.

But you mentioned DSOs were going to go into more the normal ranges of 60 to 75 days. So are we going to see cash flow -- should we expect -- should we not be modeling cash flow being this strong going forward? I just want to make sure of that.

And then also just a clarification, the positive $14 million on the cash flow statement from the fair value of the preferred stock warrants, that is simply a non-cash charge that is on the income statement added back? I mean there is nothing funky involved with that, is that correct?

That is correct, the $14 million is a non-cash one-time charge. So it was a preferred stock warrant we had to market to market as it converted to common as part of the IPO and that is behind as now, hence the add back on the cash flow since it is an expense in GAAP income.

As it relates to operating cash flow, our objective is to run the business aggressively in terms of the rate at which we can invest. But at the same time maintain positive operating cash flow. Now for the quarter obviously, that is a lot of operating cash flow for a single quarter. It is reflective of the success we realized in the fourth quarter of last year as those dollars turned into cash receipts. Our guidance is we are going to maintain positive and I will just say that that was a very large number for the first quarter.

Thanks a lot, guys, nice job.

Kash Rangan, Merrill Lynch.

Godfrey and Dave, congrats on your IPO. One question for you, Godfrey. What leading indicators do you track in your business to get a feel for the pulse of overall business? And what I guess has surprised you in the last month or so with respect to how these indicators are panning out?

And one for you, Dave, I noticed that your short-term and long-term deferred revenues are up a meaningful amount more than what they have been in a Q1 versus a Q4 particularly long-term deferred. I was wondering if you could give us some insight into what really drove that pretty significant outperformance in deferred revenue? That's it for me, thank you.

Just from an outlook, we are still at that stage of life where driving growth is about driving our ability to put more arms and legs out in front of customers. And so the number one thing that I am paying attention to in addition to all of the product related activities, is really how to get our field organization expanded at the rate that is necessary for us to drive the growth rates that we require. So it is still at some point about field capacity.

Now we had a great quarter with our channel partners; our overall channel mix was up over prior quarters and against last year for Q1. So we're definitely doing a better job of working with channel partners around the world. But we still have such -- we are still in the early stage of evangelism and going out and proving to a customer what Splunk can do for them and that still requires a direct investment in sales capacity and field engineers, client architects, support people and all of that.

So I still think that is the major -- to me I don't look at macro leading economic indicators, I look at our internal leading economic indicators and it is really all about field capacity. Dave, on that --.

Yes, so --

Deferred.

Yes. So, Kash, you're right, we certainly had a significant increase in terms of growth rate on the total deferred revenue balance and a chunk of that sitting in long-term. As I've mentioned, we always have variability between term and perpetual transactions and while the weighted average lifespan of a term transaction is typically 12 months, some transactions will have up to three years in terms of the length of the term.

So we have had some important customers that have selected a term-like transaction and that is what you see reflected on the balance sheet in terms of the split between short term and long term.

Oh, great. So if you were to impute a license bookings -- I'm not sure if it is possible to calculate because you would know and we wouldn't as to what portion of deferred revenue increase was really attributable to a license type activity I suppose to maintenance type activity. Would it be fair to say, nonetheless, that your license billings project would've exceeded your license reported growth rate pretty significantly, any quantification would be appreciated.

Sure. Yes, I think what is fair to say is maintenance continues to be the largest component of deferred revenue, but there has been a trend in terms of an increasing percentage that is license.

Got it. So your license billings so-called would have grown even faster than your reported license. Would you be able to recognize license growth rate?

Well, typically when you see -- that's right in that as the percentage of deferred goes up or the percentage of license that is in deferred goes up of course, if you didn't have to defer that software because of term accounting or ratable accounting then of course your in-quarter license growth rate would have been higher.

Nice. So the quarter is actually even better than what you report if you look at a balance sheet. So, thanks very much, that is it for me.

Peter Goldmacher, Cowen and Company.

I wanted to ask you guys two quick questions, one is, very -- I appreciate the extra data on what was sold back to your installed base and particularly the detail on what was an upgrade and what was a new clients. Can you walk us through kind of the life cycle of a customer and then when we see a third coming from upgrades and two-thirds coming from new clients, is it the expectation that -- I'm sorry -- two-thirds coming from new use cases, that those new use cases will eventually come in for more capacity? Or do they buy differently when it is an incremental use case?

And the second question and easier question is, I think many people on the street have forgotten what a perpetual model looks like and the seasonality associated with Q1. So any comments you could share on seasonality in Q1 would be appreciated. Thanks.

I will try to take a swing at the first question. I might have to have Dave come in and rescue me. But let me just take a swing at it which is we have customers who have an existing index and often times about in Q1 about a third of the time it was a customer who said I would like to put more data sources in the existing index and have a higher daily average indexing volume therefore I will just add some more gigs to my server, and so they went from 20 to 50 or 50 to 100.

So that is good that is an existing in place index and we go out and sell new use cases to customers and they -- but they put the data into an existing deployment and get more value out of it. We still call it an upgrade because it is already there.

Then there is the notion of a different department or a different geography or a different division within the company who hears about Splunk and decides to stand up a separate index somewhere else doing a new type of job and that feels an awful lot like a new sale. You may have a reputation inside the company now but you are now going in and proving a new project and probably have a proof of concept and a new set of buyers and a whole new cycle to go through, and that is what we call an expansion.

Historically, it has been about 50-50 or some number like that between upgrades and expansions. Had a little higher expansion nature in Q1 which kind of tells you that we have a lot of new projects we were working on and it is actually -- those are longer sales cycles. So that is kind of the color behind how all of that works.

To your question about what does this mean in terms of our ability to go more broadly in terms of accounts. Well, I think we have a lot of use cases still in front of us in every customer where we currently -- that we currently serve. So, yes, I believe that we have a bigger opportunity in front of us. It helps. Once you get in and you have a reputation and you have software that works and you have happy customers and all of that, it puts a tailwind at our back in terms of being able to go prove out the next one.

So getting in is the hard part. But, so far, so good. Dave, was there anything else on that that's you could --?

Yes.

And, Peter, you had a second question for Dave, as I recall.

Yes the second question -- well, Godfrey, on the first part of the question, I was trying to be specific when you have an expansion, does the expansion opportunity typically buy enough capacity have they run from the first purchase or is that expansion opportunity then subsequently a capacity opportunity? And then the second question was just seasonality in the quarter.

I see. Sorry, seasonality. So that was the second one. To the first part, we help our customers size their deployments when we go in to sell a solution of some kind. We want it -- we actually want them to buy a little extra capacity because you would never want a customer to stand up a Splunk deployment and find out they don't have enough capacity to get the job done. So we help them with how much they need to buy and it usually works out pretty well.

So I don't think there is something that they learn in the second instance that they didn't learn in the first except that they just have a better idea of what data is important and we help them by looking at the use case -- the expected business outcome and we are much better able to help coach them on what data is important, what data should be left behind, how much of should they really be indexing and what the expected outcomes of that -- of those correlations are. So there is definitely a benefit to the learning but we are there from the very first purchase to help them know how much they should buy.

On the second part about the linearity in the quarter, it is enterprise software and like you said, there is this old-fashioned thing called perpetual licenses and oddly enough customers still really like it a lots. And so we are still in that business where half the business comes in month three of the quarter, its enterprise software and it is back-end loaded. So welcome to my world.

Thanks, guys.

(Operator Instructions). Brendan Barnicle, Pacific Crest.

Guys, I wanted to follow up on Brent's question about pricing. He mentioned that -- he mentioned that the pricing model isn't changing any. But I was wondering if you are seeing any change in pricing rates or in the volume discount rates that you are needing to give? And then I've got a follow-up for Dave.

No, haven't seen any significant changes in the volume discounts at scale. We've had a volume discount program in place for years and we tend to work closely with customers to -- as they expand. So we have all the controls in the field in terms of level of discount approval before it has to get escalated to the mothership and all of that. So we are pretty good at managing all of that.

The place where we will be managing a different pricing model is when Storm goes public or goes GA in that we will be charging in the cloud for how much you store as opposed to how much you index. It's a little bit different there so I will describe that on a future call in more detail but that will be a change to the pricing model that we want to report on at a future time

Just to follow up on Storm, it is my understanding that Storm is more directed at sort of the SMB and SaaS market than your traditional enterprise market?

It is a directed at developers, so it really doesn't matter what size your business is it's -- whether you are large or small, I can promise you all developers are trying to avoid IP -- that is they don't want to ask IT to provision for them a rack of servers and operating systems and all of that stuff so that they can go out and build a new project. They go to Amazon and they can just turn a few dials, they can go to heroku, they can go somewhere else and they can provision a full platform, a full development environment and turn on a certain amount of compute capacity and they can be developing in an hour.

And so we want to be there with them as those development projects go to the cloud, we want those developers to be able to connect Splunk directly to their development projects and start both logging their instants, which they need to do for quality sake and so that they will understand what they should instrument, what they should tell their app to log so that downstream they can get better operational intelligence out of that information.

So Storm is really about being upstream and helping developers during the development phase of their projects turn on and learn from how to log.

Terrific, thank you. And then, Dave, on the high collections in Q1, you mentioned a seasonality. Was there anything else attributing to that what seems like higher than usual collection rates?

Not specifically, Brendan. When we look at our own forecast, I would say that we had some collections that were early but those and again I wouldn't say it was -- it was beyond our forecast for the quarter but nothing anomalous beyond that.

Great. All right, thanks, guys.

Greg McDowell, JMP Securities.

Just one quick question. I was wondering if you could talk about trends in different verticals and any verticals that were particularly strong in the quarter or any that were a little light? And as you expand your field sales organization, are there any verticals that you are laser focused on penetrating? Thank you.

Yes, we have -- this is Godfrey. We have strength in every industry segment just because if you have a high transaction environment or you have a complex IT infrastructure, there is value that Splunk can give. We did have a strong Q1 as it relates to financial services. I mentioned in the apps section we had a large financial services sale that was specifically to manage their Microsoft exchange environment with our app for that and we had another large one that was designed specifically to support a Citrix XenDesktop environment. So it was an unusual quarter for us in that financial services was pretty strong in that quarter.

Overall on a quarter-to-quarter basis, we tend to see in one quarter financial services takes the lead and then it's telco and then it's online services and then it's tech. It is just -- we have not yet seen a pattern established that would tell us, here are the top three and it is always 1, 2, 3. It never quite works out like that.

Great, thank you.

(inaudible).

I had a question on the different use cases you helpfully called out the use cases in app performance management, IT operations management and security and I was wondering if you could provide any color in which of those areas might be driving either more new customers and more upgrades? And just a follow one to that is that, Godfrey, you called out about two-thirds from application performance and IT operations, about 25% from security. In that remainder, are there any other use cases that you see as particular promising? Thank you.

Okay. So, we have historically just for some quick breakdowns, historically we have seen about a third of our business come from applications monitoring and about a third from all types of infrastructure, Splunk monitoring the physical infrastructure. About a fourth typically from security and then it's a long tail after that. Part of that long tail would include some customers who are using Splunk to analyze their Web traffic.

I wouldn't call it -- it is not Web analytics in the customary sense, it is more about Web intelligence of taking the Web logs, typically Apache logs or something like that and putting them into a correlation of a Splunk index that has all the other device information in it. And from that they get visibility into their website performance, their transaction completion rates, their download performance, time to download, SLAs, customer pattern activity, you've got an enormous richness of data that is typically not available on a Web analytics software. So those are the big ones.

And if you say, well, which ones tend to drive the most? That was kind of your question. If there is a place where we go in and it stays -- it gets stuck or it stays static for a while, that is typically the security department. If we go into security first, we typically live there for a while before we break out. Not for any fault of Splunk but because a lots of security practitioners are used to living in their own world with her own technologies and it's rare that they've had a technology that they would want to walk down the hall and tell somebody else about. That is not the case when we go in through applications and the -- the guy who manages enterprise applications for a company or the guy who manages the physical infrastructure, those two people talk all the time because they are so dependent on each other.

So if one of them uses Splunk, they are likely to tell their peer about it. So there are places -- and then they will go tell the guys over in Web, hey, put your Web data in here and I can give you better visibility to a lot of your activities. So there is some places in IT organizationally that have a very high connectivity rate to each other. The one exception of that is security where they just haven't had that as an operating mode over the years.

So to your question, where do we go where we get the sort of fastest growth? That is typically if we go in through applications or infrastructure first. I hope that answers your question.

Great, thanks very much.

Thank you. And that does concludes our times for questions. I would like to turn the program back over to management for any additional or closing remarks.

Great, appreciate it. Thanks, Huey, for your help today and thanks everyone for your participation. As always if you have any questions feel free to contact us directly and we will help you out as best we can. Have a good evening.

Thank you, sir. Ladies and gentlemen, again this does conclude today's program. Thank you for your participation and have a wonderful day. Attendees, you may log off at this time.