Splunk Inc (SPLK) 2013 Q3 法說會逐字稿

Good day, ladies and gentlemen, and welcome to Splunk third-quarter 2013 financial results conference call. At this time, all participants are in a listen-only mode. Later we will conduct a question-and-answer session and instructions will be given at that time. (Operator Instructions). As a reminder, this conference call may be recorded.

I would now like to hand the conference over to Mr. Ken Tinsley, Corporate Treasurer and Vice President of Investor Relations. Sir, you may begin.

Thank you, Saeed, and good afternoon, everyone. With me on the call today are Splunk's CEO, Godfrey Sullivan, and CFO, Dave Conti. As a reminder, today's conference call is being broadcast live via webcast. In addition, a replay of the call will be available on our website following the conclusion of the call.

By now you should have received a copy of our press release, which was distributed this afternoon. If you have not, it is available on the investor relations section of our website.

Before we begin, I would like to remind you that during today's call we will make forward-looking statements including our guidance for our fiscal fourth quarter and our 2013 full fiscal year, expanded use of our software by existing customers, our investment in our sales capacity and field operations, and our product enhancements. We caution you that such statements reflect our best judgment based on factors currently known to us and that actual events or results could differ materially.

Please refer to the documents we file from time to time with the SEC including the Form 8-K filed with today's press release. Those documents contain important risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements.

Forward-looking statements made during the call today are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Splunk disclaims any obligation to update or revise any forward-looking statements to reflect events that occur or circumstances that exist after today.

We will provide guidance on today's call but will not provide any further guidance or updates on our performance during the quarter unless we do so in a public forum.

During the call we will also discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results is provided in today's press release and on the investor relations sections of our website. The projections regarding our non-GAAP operating margin that we provide today excludes stock-based compensation expense which cannot be determined at the time and therefore not reconciled in today's press release.

With that, let me turn it over to Godfrey.

Thank you, Ken. Hello, everyone. Thank you for joining our Q3 earnings call. I have to tell you that my exec team accuses me of being an obsessive perfectionist, but I can usually find imperfection even in good results. But this time I just have to admit it, the Splunk team delivered really impressive results across the board -- every product, every geography, every function -- I'm very proud of our team.

Before addressing the business results, I would like to welcome our newest Board member, Steve Newberry. Steve has an impressive track record as the Chairman and formerly a CEO of Lam Research. I know that Steve is well-known to many of you. I look forward to working with him on our Board.

I also want to take this opportunity to thank Erik Swan for nine years of leadership on our Board and I look forward to his continued energy and vision as our CTO.

Now onto the quarter. Revenue was $52 million, up 67% compared to Q3 of last year. License revenue, $34.6 million, up 56% compared to the same quarter last year. We added more than 350 new customers including China Mobile, Daimler AG, Kohl's Department Stores, the US Department of Education, South Australia Police, and my personal favorite, Churchill Downs.

As we have done on our past calls, I would like to report on three core initiatives. Splunk as an enterprise data engine, Splunk as a platform for absent developers and investing for growth, which Dave Conti will cover.

Let's start with Splunk as an enterprise data engine. We recently launched the latest version of our flagship product, Splunk Enterprise 5.0. Customers are pleased with the quality as well as the new functionality in 5.0 and they are upgrading quickly. In the first week, there were more than 11,000 downloads and more than 650 of our 4800 customers upgraded to 5.0 in the first week.

New innovations in version 5.0 include report acceleration that delivers reports up to 1000 times faster. Splunk 5 also offers enterprise class scale and resilience with our new index replication technology and will soon release the SDKs for developing additional enterprise applications.

Splunk Enterprise 5.0 is driving new customer adoption as well as existing customers who are expanding to enterprise deployments.

Getty Images is a new customer in Q3. Getty is well-known as a pioneer in digital media as one of the first companies to license images online. Splunk will now help Getty track the performance of their customer-facing applications to improve their customer experience and enable real-time product analytics.

Kohl's Department Stores, another new customer in Q3, Kohl's operates more than 1100 stores worldwide and purchased Splunk for application management. We help Kohl's fix application problems faster, reduce downtime, improve application performance, gain end-to-end operational visibility, and deliver new insights through customer and product analytics.

Interactive Data is a leading global provider of financial market data and analytics and is a current Splunk customer. Interactive Data upgraded to 5.0 following their participation in the beta program. They are currently using us for IT monitoring and are now expanding their data sources to enable analytics of all their web-based offerings.

Adobe is another existing customer who is expanding their use of Splunk across the company. Among the dozens of projects at Adobe, one of their most strategic investments is their creative cloud initiative and Adobe has selected Splunk to manage, monitor, and develop operational analytics for the creative cloud service. We are really proud to be a part of this project.

In Q3, we also announced the general availability of Splunk Storm, our first SaaS offering. Very pleased with where we are in our first few months. There are thousands of new projects and about 100 paid customers using our service. Most of Storm's customers are new to Splunk, giving us some early evidence that we are reaching a new market with this service.

Just to be clear, our 100-ish new Storm customers are not included in the 350 number that I gave you earlier. Those are Splunk Enterprise customers. We will start reporting Storm customers when we have a few more quarters under our belt.

Storm is already attracting an ecosystem of cloud partners. DataSift, a leading platform provider for social media and new source insights, has integrated its cloud-based platform with Storm. In just a few minutes, users can add data from twitter, bit.ly, and many other social media sources in Storm available for analysis.

In addition to our new Storm customers, we also have cases where existing Splunk Enterprise customers are now also using Storm. Electronic Arts is a leading distributor of video games and expanded their Splunk Enterprise license in Q3 and now use both Enterprise and Storm. EA relies on Splunk Enterprise to identify fraudulent activity, code of conduct violations, and monitoring game transactions through their commerce system. With Storm, we're supporting some of the EA developers who are building cloud-based games.

It is worth reporting that we had a few six-figure wins in Q3 where customers chose Splunk because of our ability to offer a combination of on-prem and cloud solutions and our early learnings here help us better understand how to market Storm and Enterprise in an integrated fashion.

Switching now to the developer community, in Q3 we had 45 new apps and plug-ins posted to Splunk base. For example, NetFlow Logic has built an app that allows users to easily correlate NetFlow data with other sources to quickly and easily identify new insights from their networking infrastructure.

We are excited to see more developers embracing Splunk as a platform. The ecosystem is growing most visibly at our Splunk live events. Companies like Amazon Web Services, AppDynamics, Boundary Software, Centrify, ExtraHop, FireEye, and Palo Alto Networks have all sponsored various Splunk events this year.

In Q3, we purchased a plug-in that was developed by one of our partners in Europe. Plug-in which is now on Splunk base is called Splunk App for DBX. It is a SQL database extension for Splunk that enables customers to easily integrate information from a relational database into Splunk queries and reports. Our customers are frequently connecting machine events like clickstream product activity with structured data like customer account records. The app for DBX makes it easier to connect structured and unstructured data to deliver real-time customer, revenue, and product analytics. Pretty cool.

This past quarter we also announced the GA versions of the Splunk app for HadoopOps and Splunk Hadoop Connect. Hadoop Connect provides bidirectional integration to easily move data between Splunk Enterprise and Hadoop. There are lots of well-known challenges about getting data and value out of Hadoop. I hear it everywhere I go.

With Connect, we will help our customers be more successful with large-scale data storage and analytic projects. The app for HadoopOps provides real-time monitoring and analysis of the health and performance of the end-to-end Hadoop environment. These large-scale storage projects have problems just like every other IT stack and it's another opportunity for Splunk to drive customer value and success.

In Q3, we released the 2.0 version of the Splunk App for PCI. Collecting and retaining data for compliance audits is really difficult particularly since most PCI solutions require data normalization to deal with the wide variety of operational and security data formats. Our PCI app fundamental changes the pain of compliance reporting from static periodic reporting to a live interactive search environment. Managers and auditors can now ask any question of their data and get the answer right now.

In Q3, Major League Baseball expanded its use of Splunk by purchasing our Apps for PCI and Enterprise Security. They didn't have a SEM in place and their key chief security officer was aware of our success in their IT operations group. Now Major League Baseball uses the same Splunk platform to manage both their IT operations and their security departments, a trend we're seeing with many of our customers.

Splunk is tearing down departmental silos by providing an enterprise view of the data and creating new levels of collaboration. While we don't break out our apps revenues, I would like to give you some color on this. In Q3, our 2.0 versions of PCI and Enterprise Security had their best quarter ever in terms of bookings and customers, demonstrating the long-term value of our data platform and the potential of our apps business to drive success in multiple segments.

Another customer, UniCredit Business Integrated Solutions, better known as UBIS in Italy, significantly expanded their Splunk license in Q3. Like many of our customers, UBIS first success was in IT operations. Thanks to their initial success, they decided to extend their use of Splunk across the enterprise. They have now expanded the scope to monitor additional critical application systems including WebSphere, Tuxedo, and Apache, as well as troubleshooting their TIBCO infrastructure.

On another note, we want to thank all of you who attended our annual worldwide users conference in Las Vegas in September. It was a blast to celebrate with more than a thousand customers and I appreciate the time that many of you spent with our customers learning more about our business.

One of the presentations I enjoyed the most was from a customer from Harris Corporation. They were indexing data from the radar tower at JFK. Our customers showed a Google map of all of the flights on the ground, how long they were on the runway, the most efficient routes they had traveled, if they were delayed and for how long and more. It was pretty amazing. I interrupted his presentation and asked him do the airlines know that you are doing this? From across the room another customer jumps up and says -- well, we do now. I am with a major airline and I want Splunk.

Another customer presentation posed the question -- does the dimmer switch on a light really save electricity or does it just dim the lights? The audience was split down the middle on this one. Then he proceeded to prove the answer using real-time data from his circuit breaker panel at home driving real-time graphics in Splunk. These are pretty fun times because our customers are so creative.

In closing, I just want to extend my compliments to our employees and partners who have delivered our Q3 results. I also want to thank our more than 4800 customers around the world who have helped us in so many ways. Whether they are speaking in our conferences, participating in our beta programs, contributing to Splunk answers, or creating new apps on Splunk base, we have some amazing customers.

Now for more on how we are investing for growth, I'll turn it over to Dave.

Thanks, Godfrey. Good afternoon, everyone. Thanks for joining us. Despite the challenging environment for the software sector recently, Q3 was another strong quarter for Splunk. Our third-quarter results exceeded our plans and we reached several significant milestones. Third-quarter revenue was our highest to date and totaled $52 million, a 67% increase over Q3 of last year.

License revenue was also the highest we recorded in the quarter and totaled $34.6 million, an increase of 56% over last year. As Godfrey mentioned, our customer base grew to over 4800 in total and our existing customers continued to buy more.

As I've detailed before, our existing customers will buy more software for both expansions into new departments or use cases and for upgrades of additional capacity in an existing Splunk instance. Q3 was our fourth consecutive quarter where our existing customers represented more than 70% of the quarter's license bookings even while we added more than 350 new customers in each of those quarters.

In the past, upsells have been split about evenly between expansions and upgrades. However as more of our customers move towards the next phase of operational intelligence, we are experiencing a shift in the upsell mix with two-thirds coming from expansions and about one-third coming from upgrades.

Large orders, which we define as those greater than $100,000, totaled 125 in Q3, up from 77 in the year ago quarter and 98 in Q2. This is the first quarter where we've recorded more than 100 large orders.

From a geographic perspective, we are pleased with the results from our continued investments in the expansion of field coverage and capacity. Consistent with prior periods, international operations represented approximately 20% of total revenue. In Q3, all three of our major geos, the Americas, EMEA, and APAC, each grew 60% or more on a year-over-year basis.

We continued our capacity investment by adding 27 quota carriers in Q3 ending with 144 in total. Given our ability to successfully attract high-quality sales teams, we now expect to end the year with approximately 160 total quota carriers, an increase from the 140 to 150 estimate we provided on our last call.

Our other major area of investment focus relates to products. Consistent with our mission of enabling and supporting the Splunk platform, we continued to invest in our development organization's abilities to expand our Enterprise Product, our apps and content, our SDKs and developer environments, and importantly, our cloud-based offering via Splunk Storm.

As Godfrey discussed, we are pleased with the early momentum we have realized since GA of Storm and we will continue to build capacity and infrastructure to deliver this offering at high scale.

The consistent acquisition of new customers and the continued upsell success in the installed base is evident both on our revenue lines and on the balance sheet. Specifically, our deferred revenue balance continues to grow and totaled $74 million as of the end of Q3, more than double the balance from the same quarter last year.

Our maintenance renewal rate was 91% consistent with Q2 and in line with our ongoing expectation of between 85% and 90%. As a reminder, we calculate our maintenance renewal rate on our rolling 12-month basis.

As I previously described, the mix between term-based and perpetual license sales will fluctuate from quarter to quarter. Term-based license sales have historically ranged between 10% and 20% of any quarter's licensed bookings. In Q3, the mix was slightly lower at approximately 7% of license being term. This compares to 17% in Q2 and 11% in Q1.

As is often the case with larger software transactions, there are certain revenue recognition rules which caught some of our Q3 perpetual contracts to be deferred and reflected on the balance sheet. We expect to see continued variability in the mix between term and perpetual licenses based on customer buying preferences and expect some perpetual transactions in the future to be deferred as well.

Regarding margins and profitability, overall gross margin was 89%, in line with prior quarters. Gross margin on support was 88% and professional services margin was slightly positive. We recorded seasonally high levels of professional services and educational revenues in Q3 in connection with our users conference. Service revenue represented 9% of total revenue for the quarter versus 6% last quarter.

Overall, our non-GAAP operating margin, which excludes non-cash stock-based compensation, was a negative 1.3% in the quarter, better than the negative 4% to 5% we previously guided. Non-GAAP net loss was $800,000 or $0.01 per share. Our favorable operating net margin performance in the quarter was due to our higher revenue growth offset some by our headcount growth, where we ended the quarter with just over 650 total employees, an increase of almost 200 from the start of the year.

Cash flow from operations in Q3 was $6.5 million. Free cash flow was $4.2 million and we ended the quarter with about $273 million in total cash. Cash flows will continue to vary from quarter to quarter based on the linearity of in-quarter bookings and collection timing of receivables.

DSOs in Q3 were 71 days versus 70 days last quarter and in line with our 60 to 75 day expectations. We expect to continually run the business with positive operating cash flow with Q4 historically being our strongest cash flow quarter of the year.

Turning to guidance, for Q4 we expect total revenue to be between $58 million and $60 million split approximately two-thirds from license and one-third from services. When combined with our Q1 through Q3 actual results, this translates to expected full-year revenue of approximately $192 million to $194 million, an increase over our previous guidance of $183 million to $186 million.

These higher revenue estimates paired with our continued investment and scaling the overall business translates into some improvement in operating margins. Specifically, we expect our Q4 non-GAAP operating margin to be a positive 3% to 4%. For the full year, we now expect non-GAAP operating margin of between a negative 1% and a negative 2% versus the negative 2% to negative 3% previous provided.

Our weighted average share count was 96.7 million shares at the end of Q3. Because we expect positive non-GAAP operating and non-GAAP net income in Q4, remember to use our estimated fully diluted weighted average share count of approximately 116 million shares when calculating Q4 EPS. For the full year, also remember to calculate our share count as if we had completed the IPO on February 1, about 97 million shares on a pro forma basis.

Overall we are very pleased with our Q3 results and our progress around the expansion of our product and field capabilities. Thanks much for your time and interest. With that, let's open it up for questions.

(Operator Instructions). Adam Holt, Morgan Stanley.

It looks like a terrific quarter. So the first question obviously, while it sounds like it might be a little silly in the context of that, but we've heard from a lot of companies that things got difficult at the end of the quarter and obviously the macro has been tight. Did you see any change in buying behavior at the end of your quarter?

What kind of assumptions do you have in terms of closed rates and coverage as you look into the next quarter where the guide implies a little bit of a slowdown in license revenue?

You know what was kind of interesting about flows of our quarter given the October 31 date was it just happened to coincide with Sandy coming ashore. So compared to customers who have -- compared to companies that have a normal quarterly closing period, we were a bit unique in terms of being in the handful of companies who were closing right at the same time that the entire East Coast was kind of closed. So I think it speaks a lot to our linearity and the fact that we weren't dependent on the last 24 hours of revenue in order to post the results.

So we didn't really see a big change in terms of our linearity during Q3. It was actually pretty good. So that's probably it. It was just a very healthy quarter all around.

Q4, we always look to Q4 and know that if there's a quarter in the year where we will have large transactions and unknown ratability or term or all the distinctions between perpetual and term and all that, this is the quarter, so our guidance sort of reflects that.

If I could just ask a quick follow-up on the apps, it sounds like you're getting great traction with the applications. Do you have a sense for what percentage of your deals are driven by applications or touch applications? And as you look at that business, how do you think about monetization on a going forward basis? Thank you.

Well, the apps help a lot because almost any time you go into an environment if you are not selling one, you are certainly demonstrating one. Even the many that we offer for free like our app for VMware, our app for Microsoft exchange environments or for the Cisco security gear, it puts a face on the Splunk that both shows the customer exactly what Splunk can do for them and it also shows how we can speed the deployment down to days or a week instead of having to start from scratch. So the apps are enormous enablers.

Of the hundreds that are up on Splunk base, we only charge for two of them, PCI and Enterprise Security so it's a little early to say how much revenue apps will portend in the future. Those are the two that we've been developing for quite some time that have now reached a 2.0 stage and are pretty mature and have workflow and a lot of sophistication built into them. But certainly the apps themselves, the templates, the plug-ins, they are a big part of the Splunk ecosystem and what separates us from the pack. So very bullish about the progress we are making there.

Terrific, thank you.

Kash Rangan, Merrill Lynch.

Thank you very much, team. It's good to see you guys get into the cloud model relatively soon relative to a lot of other application software companies that didn't decide to push into the cloud at a later point in their lifecycle. So it feels at one level what could be argued as a destructive threat for you guys, you are actually embracing that potentially destructive threat and you have already gotten 100 customers. Any way to think about what this might do to revenue opportunities as we look at our models for next year just to get some rough ballpark?

And I had a follow-up question but I will wait till I get your thoughts on the cloud. Thank you.

Yes, it's too early. We will give guidance next quarter when we report Q4. Right now all the Storm activity that we see has been new customers for Splunk and a few Enterprise customers who have found they have projects that work really well up in the cloud. So I think that it's probably too early to describe impact on revenue. Right now it kind of feels like all plus.

Storm was not -- was de minimis in terms of revenue for the quarter but certainly think the potential to have just additional offerings is really good for us.

As I look at your guidance for upcoming Q4, it feels like there's a lot of variable this year which you pointed out to the term versus the regular license, what goes into deferral, etc. Is that what causes you to take a more conservative view on the license growth rates?

I ask that only because I look at the trend in sales capacity growth rate. After a few quarters where you were growing a sales organization at a less rapid rate, it looks like based on the trajectory we're starting to see a reacceleration in the numbers. So I'm just curious to reconcile that reacceleration in your sales headcount growth rate with your license guidance, which appears to be conservative. That's it for me, thank you very much.

As we've mentioned before, the kind of productivity for our new sales guys can be anywhere from nine to 12 months so we are certainly happy with the rate at which we have been able to attract and bring on board high-quality sales folks. But in terms of how much we anticipate they contribute to the top line, we see that really toward the back half of next year.

As it relates to the fourth quarter, your question about the variability between term and rev rec, our experience has been that the fourth quarter has been our largest in terms of bookings historically and also had our largest number of variable type accounting transactions, whether that be for the size of the transactions or the volume of the transactions -- we tend to do, we tend to experience more variability in term or perpetual that becomes ratable. So that's reflected in our guidance.

Thank you. Philip Winslow, Credit Suisse.

Congrats, guys, another just killer quarter. Very impressive new customer growth and obviously the thing that really stood out to me in particular was just those large order metrics you gave. Obviously a lot of those probably coming from existing customers. And so my question is you talked about the mix of revenue from existing versus new and also capacity versus expansion. Expansion just continues to be a homerun for you guys this year. What are the use cases that are really driving that expansion?

And obviously you made some sales changes at the beginning of the year to really push into the existing customer base. What inning are we in as far as seeing those changes really take effect?

Second inning. Anything else? Thanks for the question. You know, you were there at user conference. You've attended a lot of Splunk lives. You've seen this stuff up close and personal and so there are some things that are consistent to the customer base that you kind of hear from city to city and that's the stuff like application management and infrastructure and operations and security.

Now what we are seeing in terms of the expansions is that customers are beginning to take that -- take those cross silos and tear those walls down and start to use Splunk on more of an enterprise basis. So we will have customers by -- who might have had 100 gigabyte licenses in multiple departments and they come back and say okay, now we want a multiple terabyte license and we're going to have one big data -- one big bit bucket and the departments can all search into that data with access controls and all that. But they are able to get a lot more value because we have put more data into the engine.

Then the thing that's sort of new that we are seeing more and more often now especially with customers who have large customer facing web apps is that that Clickstream data, the Apache logs, the authentication data from mobile devices, all that is being thrown in and they are getting product and customer analytical information on top of all the sort of infrastructure, app management, security type stuff, so it's really seeing more of Splunk being used across the enterprise as a big data engine that's driving a lot of this growth.

And so the new customers are still coming on. We are very pleased with that but when you see the three geos all performing at 60% plus, it was widespread health and widespread customer acceleration and expansion across the globe.

If I could pick on somebody, I would have already done so and I can't find anybody to pick on this quarter.

That sounds great. Just one quick follow-up, one of the things that really struck me from dot-coms this year was just so many things that you're doing around Hadoop and the ecosystem there from the Splunk Hadoop Connect to the Splunk App for HadoopOps. What are you hearing from customers about sort of this vision of being a unified platform for both real-time and batch processing really frankly across sort of just multiple data repositories?

I was just having breakfast about a month ago with a CIO of a multibillion, tens of billions of dollars company and I asked him, I said -- when you hear the term big data, what does that mean to you? And he just laughing and he said, you know, our data was always big. There was nothing that happened recently that caused it to become big. So to me, the CIO, it's a total hype cycle. But he said yes, my guys are experimenting with Hadoop and we are trying to throw some data in there and see what happens and so forth.

But he said, you know, the question I keep posing to them, is what question are you trying to solve? What problem are you trying to solve? And that's where I think our Connect app can really make a difference. So many customers I talk to are frustrated because they throw a bunch of data into Hadoop and then they don't know exactly how to get it out. It's kind of hard. It is a whole stack of tools.

We're giving them a new way to do that, which is bring the data into Splunk and index it and then you can use it live and then you can archive it into Hadoop and when you need to get it back, Splunk can pull it right back out and provide you easy search language analytics on that information.

So we are just sort of -- we view that as a great way for Hadoop, great cheap batch storage. Splunk, easy to use real-time analytics and more and more of our customers are coming back to us and saying yes, that makes perfect sense to me.

So I think both our app for connecting to that environment plus our app for monitoring that environment will help provide value to those customers who have sort of gotten stuck. So it's too early to tell but you will hear it directly from our customers since we are pretty open about that stuff. I suspect that Splunk lives over the next six months will start to see what the customer evidence is.

Awesome. Congrats, guys and can keep up the great work.

Brent Thill, UBS.

Thanks, Godfrey. Just to follow on the expansion comment, as you mentioned you are going more enterprise wide. Are you starting to see customers ask for more standard enterprise license agreement or are you still at this point sticking with the daily index model and you feel as you go broader that that model will continue to hold up as you're (inaudible) new use cases?

Good question, so this question also came up last quarter and probably will for a while. But the specific answer, the daily indexing volume is still a pretty good proxy for how big is the project? How many data sources are you trying to put in? How complex are the correlations? How many people do you expect using it? So it's still a reasonable proxy for how big is big and how complex is complex?

So we are not at this moment trying to figure out some other way to do it like let's look at numbers of users or number of searches or how much you store. No matter which metric we pick, other than what we use, customers won't like that one either. So then the question becomes how do you help these large enterprises expand and give them a model where they are encouraged to put more data into Splunk instead of being very stingy about putting data into Splunk?

So we are kind of testing some notions right now. It's a little early to declare but -- and part of what we see in Q4 is that as some of these large transactions come in, we want to be able to say to a customer, okay, here's 5 terabytes of capacity and here's some additional capacity so that you can be encouraged to put more data in. I want to create the same model as our premium model, where you encourage people to do things as opposed to discourage.

So we haven't quite gotten it nailed down. I'm not quite ready to announce anything but I can tell you we're out experimenting with some things with customers and we are getting really great feedback. And so more on that as time goes on but we are of course working this issue because it's in our best interests and our customer's best interests for us to take our existing model and improve on it for enterprise adoption.

Hopefully that answers your question but let me just calibrate, is that more or less what you were asking?

Yes, that's great. That's great color and looking forward to hearing more as you go.

Just to circle back to Adam's question on the applications, clearly that's an area that your customers love. You can get up and going and it's helpful. I guess from the perspective of monetization, two of the 100 plus you are charging for, is it just in your opinion a matter of time before those apps mature and then you're able to monetize those apps or what are the obstacles or I guess barriers that you have to remove before you can start monetizing that?

Yes, you guys would enjoy attending my staff meetings. This is like a live topic of animated discussion. So we have recently been working on the naming and this is pretty important so we used to call everything an app and you guys have seen that. We are really trying to break this down into apps, into templates, and plug-ins.

And a plug-in would be like what I talked about, the DBX plug-in. It's like a connector. It's a data source type that's kind of wired up so it makes it really easy within a Splunk system to go get a customer record out of a relational database. Well, that isn't really an app. That's a connect -- it's a plug-in. It helps you connect to a relational database. That's not the kind of thing that I would see us charging for in the future even though a lot of our competition charges for those sort of plug-in connector type things. We give all that stuff away. And our customers help build a lot of that stuff so it's part of the benefit of the Splunk ecosystem.

Then the distinctions get a little bit grayer when you talk about templates and apps. So our VMware template is a set of plug-ins and it's a set of dashboards and you can set it on top of a Splunk [instance] and it will help speed the deployment of Splunk in a VMware virtualized environment but the customer will do some additional customization on top of it and all that. So a template is what I think of the sort of the framework.

Apps are what I think of as finished products. They are on the pricelist. They have documentation, full support, warranty representation -- they have the Good Housekeeping Seal of Approval from Splunk and they're fully productized with a lifecycle.

The only two we have that meet that test right now are PCI and Enterprise Security but as time goes on, some of those things that are in template land sort of framework land now could go ahead and emerge out in a 2.0 or a 3.0 version into a full app and I wouldn't be surprised at that form at that time and in that format that we choose to charge for them because we've put an enormous amount of development work into it.

So the future will tell but if I had to predict I would say a year from now we will have more than two apps that we charge for because of the amount of maturation that has occurred for those what might now be a template. So stay tuned but this is about time and development and maturity and then customer appetite for the value.

Great, thank you.

John DiFucci, JPMorgan.

For Dave, current deferred revenue was strong in the quarter. Actually quite a bit better than we were looking for, but your long-term deferred revenue declined sequentially and was below what we were looking for I guess. I realize that long-term deferred is not a big part of deferred but it has become larger over time and I'm just curious is this decline in matter of customers still engaging with Splunk? Because every indication is that is happening or even happening more. But it's less likely to engage longer terms?

I mean, I realize you engage with your customers and if they sign a multiyear term deal somehow versus the first year and it's nice to see that 91% renewal rate, Dave. You know I was listening for that but --

I think of you, John, every time we calculate the maintenance renewal rate, I just want to say.

But I'm just trying to get -- because I'm trying to get back to the macro even to Adam's question at first and just trying to -- it sounds like people are still engaging a lot with Splunk and even more so. But is something -- are people less likely to engage for longer-term contracts or was there just something -- some reason why that's gone up -- the long-term deferred over the last couple of quarters. Was there something that that's just bleeding off now?

I think it's really just the law in this case of small numbers, John. So when you have a number of large transactions again typically some of the ratable transactions or term transactions will be larger in nature and as those multiyear transactions get pushed into long-term, if one of them gets to the end of a period or it moves into current, it can have an impact because the long-term deferred balance just isn't that high.

So it's not really a buying pattern as much as a commentary on scale. We're not -- we are not explicitly driving the field to sign long-term transactions versus short-term transactions. We are trying to sign customers up for the type of transaction they want.

Okay, okay, that's helpful. Thanks a lots, guys. Nice job.

Raimo Lenschow, Barclays.

I just want to follow-on on the question that Kash had earlier. You mentioned in previous calls that the expansion of the sales price is driven by the visibility that you have, so if you see opportunities then you know it's worth expanding. You now have made quite a big change here.

Can you talk a little bit about the potentially increased opportunity or your thinking around that?

And then also a second one is if you look at the competitive field, we just saw some big fund-raising at Sumo Logic. Lock Logic is kind of now a software solution [around appliance]. Can you just talk a little bit about what you see in the market in terms of competition? Thank you.

Sure, so let me just take the field one first. We operate our field organization built around a success model where we have a pretty high percentage of people who make plan and so when we look towards a new year, you can factor in some level of increased productivity per person in your field organization. But what we are really trying to do is get geographic in market and industry coverage. So when we did the segmentation model for example in the US at the beginning of this year and tiered the field organization around named accounts, geographic outside territories and then SME, which is all handled over the phone, that enabled us to target customer lists and geographies in a very specific way. And you can extrapolate now that conversation around the world and say if we intend to reach the Global 2000, the major markets, etc., we have a blueprint now for expansion and we have ambitions there. So we intend to expand as quickly as our checkbook will allow us to do so.

And Dave is my -- he is the dad who won't give you any more allowance. I continue to ask for more allowance and he continues to say no. But within the limits of our financial model, which is to be cash flow positive and strive to grow to profitability, we are going to expand as fast as we can. So that's kind of what's going on in the field model and you see it in terms of our hiring now.

David talked -- I'm spelling him because he had the flu today so I'm giving his throat a rest here. But he had talked to everyone last year about how we had spent last year sort of gearing up the back office to get ready for the IPO and therefore within our hiring plan, we had gotten a little bit behind in terms of field expansion. We saw that constraint in our capacity in sort of the Q4, Q1, Q2 bridge coming into this year so we're trying to get back on track and get back to a level of field expansion that we think is commensurate with the market opportunities.

So that hopefully we are on sort of a track that we can stay on for a while. So I hope that answers the question around productivity. Anything else on the productivity and then I'll go to the competition.

Perfect for me.

All right, so let me just switch over to the competition. So we continue to see competition all over the world. It still feels about like it has over historical times. That is if you are in an application management compete, there will be a handful of folks there. If it's infrastructure, you will see some of the same or different. You get into security, it's usually security-specific competitors. If you are in the world of sort of web intelligence, there will be a different cast of characters. And then you've got the ones in the cloud.

So we sort of know who they are and we know about when and where we compete so I don't see any major difference in the competition. What I see is that it makes us better. All that competition makes us better. It just gives us more points of comparison between what we do and others. It gives us more reference points in terms of what functionality customers care about the most. So it's all good. Competition is good for all of us. It makes us raise our game.

Perfect. Thank you and congratulations for me as well.

Ed Maguire, CLSA.

Good afternoon. I saw that the maintenance and services increased pretty significantly sequentially and I know you called out that you did have a higher component of training and services. But is this a level that you would expect -- is there seasonality that's going to be baked in around Splunk.com or is this a level that you expect to be more sustainable going forward on the services side?

We definitely have experienced a seasonal bump in our third quarter in connection with the users conference and that was consistent with Q3 as well. At the same time similar to our field capacity, we are looking to continue to grow our direct consulting organization and services as well as our ecosystem of partners that can deliver services on our behalf. So we think that Q3 will be seasonally high but we'll continue to build capacity in that organization going forward.

I will weigh in on that just as well. It gives me some joy to think back to the days of when I first arrived at Splunk and we had 150 employees and we had two services people and they weren't very busy because of the nature of our business at that time was mostly 1 gig, 5 gig, 10 gig types of deployments that customers they downloaded it and fired it up and they were alive and running the same day.

I have one account now where we have effectively three people who report to work there every day because we are indexing almost 70 terabytes a day into that customer and we have become a mission-critical system there and simply it simply cannot go down for five minutes.

So as the nature of the business changes, as Splunk goes from an IT troubleshooting tool to enterprise data fabric where a lot of our customers have mission-critical systems feeding Splunk and then Splunk in turn feeding other mission-critical systems, we have become in many of our customers a critical middleware component almost let a piece of infrastructure and in those environments, there will be services work and there will be training and education and the like.

So personally I think we'll start to see an increased level of our business with both partners and with their own services and education organizations because of the nature of our engagement with customers is continuing to mature and evolve and expand so be ready for a little more of that.

Thanks, I wanted to go actually back really to the sort of the new customer dynamics. I see that there has been this inflection where the expansion business is really driving a lot of your repeat business. But could you comment a bit on the dynamics of conversions of free to Splunk Enterprise and whether there is an opportunity of unconverted users out there that you see or whether you are able to track the pace of tat uptake and the size of initial orders? Thanks.

Sure. We don't actually track downloads as a conversion rate. It's never been a meaningful metric for us, but it's important that we have downloads because it creates people who know the product all over the world.

So the easiest example for that -- I will just give you two quick ones. One would be a new major account rep going after a named account, life insurance company, Midwest, doesn't allow free download software in their organization. But a couple of their people have downloaded Splunk and gotten to know it over the years on their own time or they worked at some other company where they had Splunk and so we are going in there and not as a result of any download activity at all. We're going in and breaking open the front door and we are having a conversation. But we been can find the Splunk champions that are inside that account and it operates as a tailwind to our selling efforts because we already have advocates and evangelists inside the customer.

So that's a good example and in a lot of our major account selling around the world, the download is actually not much of a factor in terms of how the organization behaves, but it's a factor in terms of us having a set of evangelists already on the ground who would help us if there was a project that they could get Splunk attached to.

In the small medium enterprise, it tends to be a little bit more direct where our inside sales organization tracks download activities as hot leads and if you download Splunk, you will get a phone call from us in the 24 hours following to say hey, is there something we can do to help you?

Those transactions tend to have a different lifecycle to them where it's really more a customer specific opportunity. Why did you download it? Were you just curious or did you have a project and so forth and so on?

So we understand the difference by download, by customer size, and by country, by geography, and they all behave differently. But it's all about knowing -- having enough velocity, having enough of that activity going on where you start to pattern match where it makes sense or not.

So freemium is really good for us but it's not -- you can't actually draw a straight line between downloads and conversion or revenue.

Great. Thank you.

Brendan Barnicle, Pacific Crest Securities.

Thanks, guys. Godfrey, we've spent a lot of time this afternoon talking about the internally developed apps but I was wondering if you could give us any more color on third-party apps and specifically if those vendors are starting to monetize their apps?

I will just give one example. I was just having a meeting this morning with a company called Prelert. They will be posting an app on Splunk base next week and it will be in I think preship condition like in its last 60 days before it goes final. These are some really hot algorithm guys, mathematicians out of Austin who had developed an approximately monitor -- it's basically predictive analytics for application monitoring and its functionality that is beautifully adjacent to and complementary and beyond what Splunk does.

So as they were developing that app, they looked around and said, well, we could go chase CA Unicenter or HP OpenView and try to become an adjacent product to that theme and just go chase that business and be the predictive analytics business for it. Or better they could say, well, let's go chase the volume leader. How many people -- how many customers -- how many companies have 4800 customers all over the world, 75 countries and a really easy to use product that we could then -- .

So what did they do? They built a predictive analytics tool that sits right on top of Splunk. And so it's a phenomenal anomaly detection system that helps identify patterns and behaviors and anomalies in application performance that customers when they see it, they just love it.

So just an example, okay now we need to figure out how to get those guys into our Splunk lives and get them more exposure and get them more visibility to our customer base and on and on because as their app goes on Splunk base, they want someday to monetize that app and we want them to monetize it and become a successful company and more power to them.

So yes, there's a lot of customers now. There's a lot of other companies that are starting to build plug-in apps, if you will, for the Splunk environment because of our volume and we are an open company. We have that philosophy and attitude and we want to help all those customers be successful so I'm thrilled about where we are.

It's still early days. This is still early days but we're making really good progress and I'm bullish about where this thing can go.

Best example, best evidence of it, if you come to a Splunk live now, there will be four or five people in every town exhibiting in the Splunk out in the lobby and we will have 200 or 300 people attending and companies are coming to us now and volunteering to sponsor our Splunk lives just so they can show their apps and their plug-ins to our customers. So I'm really very bullish about where we are going with the ecosystem.

That's great. Then Dave, in the past you guys have talked about how customers are typically buying twice their original purchase during the following two years. I think based on the metrics you give us that metric still held. Was that true or did it change at all?

No, that's true. That pattern continues.

Then also did you give us -- I might have missed it -- did you give us what the growth rate in new customers was year-over-year?

We did not.

It was about even in terms of the number of new customers was about the same as this quarter last year. I can't remember, but it was about -- we had about 350 last year and we had a little -- I rounded down to 350 this year but it was about like that.

Great. Thanks, guys.

Peter Goldmacher, Cowen and Company.

Thank you. Guys, I wanted to ask you just a quick question. Can you tell me what you think your percent of revenue is from deployments that are built around security and IT operations?

And Godfrey, you gave that interesting example with Harris Corporation and the thermostat and very nontraditional Splunk deployments. So I want to know what's the more traditional business and how are you going after the less traditional business that is market opportunity, represents market opportunity multiples larger than the current healthy market you are still in?

Peter, you got me on one of my favorite topics. So I will try to keep this brief. Security was about 30% of the quarter, this quarter and it kind of varies between 25% and sometimes in the low 30%s. IT operations more or less like that and app management about like that.

So if you say -- if you just broadly bucketed Enterprise IT operations, that would be the applications and the underlying infrastructure, that would typically be 60% or maybe a little more in any given quarter and security would be a third. Just think of it as one-third and two-thirds.

But the long tail and some of the other emerging trends have to do with matching up that data with real-time product analytics and Clickstream information and mobile and on and on so we're starting to see more and more decisions made around revenue analytics because we have this ability to provide in very short deployment times real-time product analytics about almost anything.

So back to the fun examples, nobody on the call -- see I didn't give the answer to you yet about does a dimmer switch save electricity or does it just dim the lights? None of you guys have asked me for the answer to that yet. So I don't know. Should I tell them the answer?

So the room is split 50-50. The answer is if you dim the lights, it actually does save electricity and he proved it out by having a real-time time time chart of his power consumption right off his breaker panel, so all you guys start using your dimmer switches.

We didn't ask. We already knew that.

Yeah, you didn't know that. So now here's one more example. The second part of your question was about how about all these nontraditional use cases? So a couple of weeks ago I have a senior ranking official from a European car manufacturer in to see Splunk and we'd worked on a project with them and they want Splunk to gather all the data that's being transmitted wirelessly from their electric cars to back to the headquarters.

The number one -- in their view -- the number one resistance factor of consumers to electric cars is battery anxiety. So how do you solve that? Well for the one thing, you have to put charging stations all over the place so when you go to the grocery store, you can just drive your car up and plug it into a charger while you are in getting your groceries or what have you. You guys know what I mean.

But how are they going to know the health of the infrastructure for charging stations? Well, the answer is, the cars will have it. The cars as is it getting charged, it will have that information in its little onboard computer and it will just transmit that data wirelessly back to headquarters.

So we wired up -- they wired up 6000 cars and we spent a few weeks testing all that data that was transmitted back to the servers at headquarters that are gathering all those logs. We were able to show them not only what the health was of all those vehicles but we actually showed them that the contract they had with the wireless provider in Europe needed to be adjusted because the bandwidth they needed to transmit all that data was far beyond what they had contracted for, so we saved them in the project, in the PoC, we saved them millions of dollars in cell phone charges just by showing them bandwidth consumption.

So one of the most fun parts about working at Splunk is you never know quite what you going to find in the machine events but if you just crawl around and look in there, there will be something -- you will solve the expected and you will solve something that is highly unexpected and that's what keeps all of us young. Thanks, Peter.

Great. Thanks a lot.

Saeed, we have time for one more call.

Shebly Seyrafi, FBN securities.

Thank you very much. So you are guiding conservatively right now I think around I would say around 17% growth sequentially. A year ago you grew almost 40% and I would like to know -- you have Splunk Enterprise 5 that just started shipping at the end of October. What's different this time versus a year ago when you grew almost twice as much as you are guiding this quarter? Sequentially?

It's really the difference between bookings and revenue. It's back to that notion of in Q4 last year in Q4, we had a phenomenal quarter, phenomenal and so that's not what you necessarily want to use as your planning baseline. But the other thing is we know based on some of these enterprise adoption models we're driving, some of these large-scale deployments that we are driving, we know that the likelihood of all that data being recognized as in quarter perpetual is different. So it's not prudent for us to model quarterly guidance based on a high perpetual rate.

So we fully expect a strong bookings quarter and we think the guidance is appropriate based on how much revenue would be recognized in quarter.

Okay, and you did note earlier that your growth in Europe was in line with growth in the other areas at roughly 60% plus. But for calendar Q4, fiscal Q4, do you expect or are you seeing any weakening trends in Europe for example? And do you expect Europe just to grow in line with the other geos?

We had a different issue in Europe, which was we had a change in leadership around the first of the year. We had a couple of quarters in Europe where Europe was behind the other geos in terms of its growth rates and I was really excited in Q3 to see that they had kind of recovered and we are now matching up with the other geo-growth rates.

You can't be optimistic about what's going on in Europe but we are still in sort of the law of small numbers where we are still signing up so many new customers and expanding at relatively small dollar volumes that I think we can fight the macro trend there for awhile.

Okay, thank you.

Okay, Saeed. Thank you. I appreciate it and thanks for everybody's participation. We are here in Cupertino. If you have any follow-ups, we would be happy to address any questions you have. Thanks and have a good evening.

Ladies and gentlemen, thank you for participating in today's conference. This concludes our program for today. You may all disconnect and have a wonderful day.