Splunk Inc (SPLK) 2013 Q4 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the Splunk's fourth quarter 2012 financial results conference call. At this time all participants are in a listen-only mode and later we will conduct a question and answer session and instructions will follow at that time.

(Operator Instructions)

And as a reminder, this call is being recorded. I would now like to introduce your host for today's conference, Ken Tinsley, Corporate Treasurer and Director of Investor Relations. Sir, you may begin.

Great. Thank you, Bethany, and good afternoon. With me on the call today are Splunk's CEO, Godfrey Sullivan; and CFO, Dave Conte. As a reminder, today's call is being broadcast live via webcast and an audio replay of the call will be available on our website. By now you should have received a copy of our press release, which was distributed this afternoon. If you have not, it is available on the investor relations section of our website.

Before we begin, I would like to remind you that during today's call we will make forward-looking statements including our guidance for our fiscal 2014 first quarter and full-year, expanded use of our software by our existing customers, the size of our licensed purchases, our investment in our sales capacity, field operations and vertical markets and our product enhancements. We caution you that such statements reflect our best judgment based on factors currently known to us and that actual events or results could differ materially. Please refer to the documents we file from time-to-time with the SEC, including the Form 8-K filed with today's press release. Those documents contain important risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements.

Forward-looking statements made during today's call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Splunk disclaims any obligation to update or revise any forward-looking statements to reflect events that occur or circumstances that exist after today. We will provide guidance on today's call but will not provide any further guidance or updates on our performance during the quarter unless we do so in a public forum. During the call we will also discuss non-GAAP financial measures. These measures are not prepared in accordance with generally accepted accounting principles. A reconciliation of the GAAP and non-GAAP results is provided in today's press release and on the investor relations sections of our website. The projections regarding our non-GAAP operating margin that we provide today exclude stock-based compensation expense and payroll taxes related to employee stock transactions, which cannot be determined at the time and, therefore, not reconciled in today's press release.

With that, let me turn it over to Godfrey.

Thank you, Ken. Hello, everyone. Welcome to the call. Q4 was strong. Revenue for our fiscal fourth quarter was $65.2 million, up 51% compared to Q4 last year. License revenue was $46.8 million, up 43% compared to the same quarter last year. We finished the full fiscal year at $198.9 million, up 64% over last year. We added more than 400 new customers including DuPont, Poste Italiane, Siemens Energy and The University of South Australia and the Department of Homeland Security's Emergency Readiness Team.

We now have more than 5,200 customers worldwide, including over 60 of the Fortune 100 and about 200 of the Fortune 500. Eight of the top 10 companies in the Fortune 100 are now Splunk customers. In the past year we added 11 new customers from the Fortune 100 list, including 5 in Q4 alone. And we added about 30 new customers from the global 500 last year, 11 of those in Q4. With 400 new customers this quarter, not including Storm, our new customer additions are consistent with last year and the mix is much more weighted towards global accounts reflecting strong evidence of where our field investment model is really working.

One particular customer when, in Q4 that I'd like to call out, is an eight-figure, multi-hundred terabytes per day transaction with a technology company. It stands as the single largest transaction in Splunk history and it represents the kind of adoption we've discussed before where we enable our customers to standardize on Splunk. We have a team of people who report to work there every Monday and we operate as one team. This is a result of a six year relationship that grew from departmental to multi-departmental, driving ongoing customer success and we are now the standard for managing their machine data. Use cases includes security, infrastructure, customer authentication, content delivery and overall customer experience. It's all in the logs and it's all in the teamwork.

Another customer that expanded their use of Splunk Q4 and is standardizing on us is StubHub. StubHub is an online marketplace owned by eBay which provides services for buyers and sellers of tickets to sporting events and concerts. In addition to Splunk Enterprise, StubHub also licensed our app for enterprise security.

We've discussed this theme of customer expansion on prior calls. As more of our customer relationships evolve from departmental use cases into enterprise deployments, we often sell a multi-year ELA and I'd like to give you some additional color here. For FY '13, we had 25 seven-figure transactions, up from seven -- sorry, up from 11 last year, and some of these are multi-year enterprise agreements. While this isn't a number that will report quarterly, it's pretty good color for understanding our progress towards becoming a platform for machine data within our customers.

Let's move on to the markets. We continue to drive the majority of our revenue from our core markets at management, infrastructure and operations and security compliance. Introduction and expansion of Splunk software in these core markets is giving us traction in emerging Splunk markets within our customers such as web intelligence, business analytics and industrial data. Customers who licensed Splunk Enterprise for application development and management in Q4 included China Construction Bank Siemens Energy, the Korea Music Copyright Association and RailCorp. At management remains a core use were Splunk has strong competitive positioning. Our ability to read complex, multi-line events from hundreds of source types is something that delights our customers and frustrates the competition.

Customers selecting Splunk in Q4 for infrastructure and operations included Comcast, Savvis and Symantec. Customers choosing Splunk in Q4 for security included SKY Italia, Genentech, the EPA and the US Coast Guard. The security market is undergoing a fundamental shift and many of you have read about some of our competitors challenges in this space. We're seeing two major changes. The first is the nature of the threats. The days of a SIM, a rules-based engine built on a relational database looking for known threats -- those days of the SIM are drawing to a close. These old SIMs are not built to handle the advanced persistent threats of today where the attackers are constant and changing all the time. The second change is that our customers are growing weary of managing these SIMs, which are costly, take a long time to implement and are inflexible to new threat patterns.

One of our seven-figure wins in Q4 was in security with a large financial services company. Four companies were involved in the POC and only Splunk could handle the range of data sources, scale the data to massive volumes, analyze the data in real-time and demonstrate the ability to investigate new conditions.

As we take a larger role in the next generation of the security market, we're beefing up our security team. A few days ago we announced that we have appointed Tim Mather as Vice President of Security Markets and also as our Chief Information Security Officer. Tim has 18 years of experience in senior roles at companies such as RSA, Symantec, VeriSign and Apple. While Splunk is a horizontal technology and used everywhere, Tim's appointment is a good example where we're organizing and investing in our core market segments. We've also added a number of highly skilled security practitioners worldwide who bring deep operational experience to our team.

While I typically report on use cases like security and infrastructure as how we segment our core markets, I'd also like to update you on our progress in industry verticals. So briefly, in telecom, 8 of the top 10 telecom service providers in the world are now Splunk customers. Reflecting our continuing international expansion, in Q4 we received orders from France Telecom, T-Mobile Poland and Telenor Norway. We also closed and OEM agreement with [Vululsics], which is an alcatel lucent company and a leader in providing advanced infrastructures solutions for digital content delivery. Vululsics will build Splunk Enterprise into their next-generation content delivery solution. And this is because of our ability to perform large data scale ingestion and our ability to drive analytical reporting from their digital content.

Our presence among online and brick-and-mortar retailers continues to grow. The top five online retailers in the world are now Splunk customers. In Q4 we also signed on GOME Electronic Appliances. They're one of the largest electronic appliance store chains in mainland China. GOME is in the process of increasing their online presence and they will now rely on Splunk enterprise to analyze and monitor their core online shopping application.

In financial services, 6 of the top 10 banks in the world are now Splunk customers. In Q4 we received orders from Moody's, Parallax Fund and many others that I can't name where all of us have our investment accounts in ATM cards. In healthcare, TriZetto is a new customer to Splunk. As an IT healthcare solutions provider, TriZetto reaches more than 200,000 care providers and about half of the US ensured population. TriZetto's technology execs know Splunk well from their previous company and, therefore, their initial Splunk purchase was a larger multi-terabyte deployment while the decision cycle was pretty short. They didn't need to do a POC. Given their familiarity and prior success with Splunk, their initial deployment will also include Splunk Enterprise as well as our apps for active directory, exchange, net app apps Cisco UCS, VMware and DB Connect. We're big fans of the TriZetto exec team and this win shows how proven success with our customers will drive future success.

On to the product report. One of our core product initiatives is to invest in content to support our core Splunk Enterprise platform. During Q4 we released the 2.2 version of the Splunk app for enterprise security with faster performance and higher scalability. The state of Nevada is a new customer to Splunk and purchased enterprise security to protect the states infrastructure from advanced persistent threats. During Q4 we released version 2.0 of our app for VMware, which provides granular visibility into performance metrics, logs, tasks, events and typology from hosts and virtual machines. It provides VMware administrators with a real-time picture of their environment, proactively identifying performance and capacity bottlenecks.

The 451 group wrote that the Splunk app for VMware allows the VMware environment to be managed in the same way Splunk customers are ready managing their physical OS and application tiers. And the 451 group confirmed what means the most to us, that our customers love the product.

For developers in Q4 we announced the general availability of our SDKs for Java and Python. And the Splunk SDK for PHP is now on public preview. We also released the GA version of Splunk DB Connect, which we acquired last fall from a Splunk partner. DB Connect delivers real-time integration between Splunk enterprise and relational databases, making it easier for customers to use structured business data and enrich it with their Splunk data. As an example with DB Connect it's easy to report your top 10 customers who are transacting business in real-time or to compare information that's in a BI report with real-time trending from clickstreams delivered by Splunk.

Now on the Cloud and Splunk Storm. We now have more than 160 customers and 200 paid projects on Storm. Some of those projects are from our enterprise customers, like Electronic Arts. Also hot web companies like Linden Labs. They're using Storm to troubleshoot, analyze and monitor their online virtual worlds, including Second Life and VO. The DO team at Linden Labs uses Splunk Storm to troubleshoot issues in the development, test and production environments. They like Storm because it's easy to get started, easy to manage and scale their data and easy to collaborate among their developers.

Wrapping up, I want to thank all of you who attended our Splunk live events this last year. We hosted, last year, 43 events in 16 countries with more than 6,000 customer attendees. And many of you have joined us and we're really happy to be able to connect our investors to our customers so that you can hear their amazing stories firsthand.

In closing, I want to highlight Splunk for Good, which is our social responsibility initiative. We did a few cool things as part of the program this year, including using Splunk software to analyze and visualize the Federal Election Commission finance campaign data. Now this wasn't a typical use case for Splunk since this was structure data like names, addresses, donation amounts. So why Splunk here? Well because we have such a flexible indexing engine, a few of our employees along with some nights of pizza and beer, created one of the most popular websites of the fall campaign. Anyone could look up contributions by name, ZIP code, city or party. It just demonstrates the power and flexibility of Splunk, a searchable data warehouse and three nights. Splunk for Good also joined the FEMA innovation team in the wake of Hurricane Sandy and spoke at the White House earlier this month to demonstrate social media metrics as a result of the impact of the hurricane and the analytical benefits from that data.

Before turn it over to Dave, I also want to say how pleased I am to be ranked number four by Fast Company in the world's most innovative companies. Fast Company also ranked Splunk number one among big data innovators because Splunk democratizes big data by bringing the value of that information to everyone.

So thanks again, everyone, for your support of Splunk and now over to Dave.

All right. Thanks, Godfrey, and good afternoon everyone. As Godfrey mentioned, Q4 was another record quarter for Splunk and exceeded our plans across the board. Fourth quarter revenue was the highest in our history totaling $65.2 million, a 51% increase over Q4 of last year. License revenue grew 43% over last year totaling $46.8 million and was also the highest we've recorded in any quarter. Full-year revenue was 64% over the prior year at $198 million. License revenue was $135.9 million, a 54% increase over the prior year.

Because Splunk delivers accelerating value as more data indexed in correlated across an organization, our customers are highly incented to capture more data in a particular use case than expand from single department to multi-department and then to enterprise-wide deployments over time. To quantify this, we evaluated the buying trends from a sample of our customer base and found that, on average, these customers spent approximately four times their initial purchase in the three years of following their original order. Consistent with this sample, Q4 was the fifth consecutive quarter where our existing customers represented more than 70% of the quarter's license bookings.

Another milestone we achieved relates to large transactions. In Q4 we recorded 171 orders greater than $100,000, which compares to 94 in Q4 of last year and 125 last quarter. Indicative of how our customers are expanding across the enterprise, it's interesting to note that of the 171 orders, 11 were seven-figure transactions. Now seven-figure transactions is not a typical metric we'll provide, rather, as Godfrey mentioned earlier, we're sharing it with you so you have some insight on how customers are expanding their use of our software.

I've talked before about our focus investments in field expansion and product development, which are reflected in our total revenue results expanded use of Splunk with an enterprise and the acquisition of new customers. Company-wide, we grew headcount by approximately 250 employees and ended the year with 736 in total. Of these, we added more than 50 in the products organization, ending with 180 total employees working on our platform. In the field we finished with 163 quota carriers, up from 94 at the beginning of the year. Now recall, it typically takes 9 to 12 months for our field reps to reach full productivity. Of those on board at the end of January, about 50% of them were in this category. Now this is an important item. Our time to productivity tends to be longer than what you're used to with other enterprise software companies.

From a geographic perspective, I'm pleased with our execution. In Q4 international operations represented approximately 26% of total revenue with APAC and EMEA posting their best ever quarters, each growing by more than 60% year-over-year. Our maintenance renewal rate was 92% for the quarter and has been trending upward over the year, reflecting our field coverage and capacity expansion, allowing us to reach more customers in countries where we historically have had limited resources. As a reminder, we calculate our maintenance renewal rate on a rolling 12 month basis.

As I previously described, the mix between turn-based and perpetual license sales will fluctuate from quarter-to-quarter based on our customer buying preferences. Term-based license sales have historically ranged between 10% and 20% of any quarter's license bookings. In Q4 the mix was 13% term compared to 8% in Q4 of last year. On our last call I said that some of our larger perpetual transactions, or what I'm referring to as enterprise adoption type arrangements, can contain provisions which require them to be deferred and treated [radably]. In Q4 we had a number of these transactions, including the $20 million order, which Godfrey referred to earlier as an eight-figure transaction. When we combined disorder with our typical type transactions, we see deferred revenue increased to $115 million at the end of the year, compared to $74 million at the end of Q3.

Adoption arrangements typically have a longer sales cycles, sometimes spanning several years. As a result, entering any particular quarter, we'll have limited visibility into how many of these types of transactions we'll close. We expect to see continued variability, not only in the mix of term and perpetual licenses, but also the number and timing of enterprise adoption arrangements in the future.

Our education and professional services are important drivers to accelerate our customer success and expanded use of our products. Services represented by 5% of revenue in Q4, in line with past levels of 5% to 10%. Now as a modeling note, since we recognize our services when they are delivered, they typically do not flow through the balance sheet on the deferred revenue lines.

Okay. Unless I otherwise state, our non-GAAP operating metrics exclude non-cash stock-based compensation as well as employer payroll tax expenses related to employee stock plans. So turning to margins and profitability, overall gross margin was 91% in line with prior quarters, and gross margin on services, which includes support, maintenance and professional services, was about 70%. Non-GAAP operating margin was a positive 5% in the fourth quarter, compared to 2% last Q4. For the full-year, non-GAAP operating margin was about 1% negative compared to a negative 4% last year. Non-GAAP net income for the quarter was $3 million, or $0.03 per share, using a weighted-average share count of about 116 million shares in total. Given our full-year non-GAAP loss, EPS for fiscal '13 was $0.02 per share and is based on a weighted-average share count of about 80 million shares. Remember, the full-year count excludes common stock equivalents given the full-year loss.

Cash flow from operations in Q4 was $24.8 million. Free cash flow was $21.4 million. And we ended the quarter with over $300 million in total cash. Full-year cash flow from operations was more than $46 million in total. DSOs increased to 90 days versus 71 days due to the timing of the $20 million order I mentioned earlier. Excluding that order, DSOs were 62 days, in line with our 60 to 75 day expectation.

Looking back over the fiscal year, I'm pleased with our continued field and product investments, our transition to becoming a public Company and expansion of our overall global presence, all the while improving our margin profile and generating substantial positive cash flows. Looking forward, we'll continue to invest in product in field expansion in fiscal '14 as we scale the business for our next phase of growth. Our plan is to invest proportionately with our topline. So for the full-year, we expect roughly breakeven operations on a non-GAAP basis. We'll achieve these operating results on our expected full-year revenue of between $260 million and $270 million. Revenue is likely to follow the seasonal patterns we've seen historically with between 40% to 45% of total revenue in the first half and 55% to 60% in the second. With that we expect Q1 total revenue to be between $52 million and $54 million.

License revenue will continue to account for about two-thirds of total revenue for the year and services, one-third. Importantly, services revenue is weighted more heavily in the first half and license revenue is weighted more heavily in the second. The bulk of our expenses will continue to be headcount driven and we expect to add about another 250 people in fiscal '14. We'll add new folks proportionately with our current overall operating expense allocations -- roughly 55% to 60% sales and marketing, about 18% to 20% R&D and the remainder COGS and G&A. With overlay with our revenue plan, we expect negative operating margin of between 10% and 12% in Q1, accreting gradually in quarters two and three, then turning positive in Q4 -- just as we've experienced in fiscal '13 and our prior years.

Overall, I'm pleased with our Q4 results and our full-year performance. Our ability to invest, not only in our infrastructure, but also our field coverage, and importantly, our product development, helped us deliver great customer success of thus far. We're looking forward to continuing these efforts for fiscal '14 and the years to follow.

Thanks much for your time and interest. With that, let's open it up for questions.

(Operator Instructions)

Our first question comes from Phil Winslow with Credit Suisse.

Congrats on another great quarter. Just wanted to dig into that one metric that you mentioned of just sales into existing customers. I know that was a big focus this fiscal year. Just maybe if you can give us an update on just your go to market strategy. I know you've been trying to cross sell inside those existing customer. Just where we stand on that as far as the US goes? And you mentioned last call potentially rolling that out internationally as well -- if you just provide an update on that too that would be great.

All right, Phil, thanks. Godfrey here. It kind of depends on which department we go into first as to how fast we expand. So it's been interesting learning experience where when we go in through app -- the app management -- enterprise applications part of the organization or through infrastructure, it tends to -- those two tend to connect pretty quickly -- those departments connect quickly.

When we go into security, because those folks have really never had a tool that they can share -- a technology they can share with other departments, they tend to think more in terms of the silo and we have to work a little harder to go from that security use case and break into other departments. But we continue to provide our field organization with marketing materials and customer use cases and training and all the rest of that so that they can use the information wherever we go in as the first use case, so then start spreading the news across the organization. So the large sale that we talked about in Q4 was a perfect example of where if you go back far enough in time, we were at a one small license and one department and, finally, a few more in other departments. And it takes time but were beginning to see evidence of it across our customer base and you see a lot of that in the larger transactions. So I'm pretty pleased with the progress there.

Great thank for that and congrats on that huge deal. That's pretty impressive.

Thank you.

Kash Rangan with Bank of America Merrill Lynch.

Thank you very much. Welcome to the mega-deal club, guys. (Laughter) It's nice to see. The billion-dollar category, whatever. Seems like a big deals. Sales Forces reported their numbers so that call's going to start pretty soon. My question for you guys -- the sales force productivity ramp, I think you're (inaudible) told us about 50% of your sales force is not yet productive. But you do the cohort analysis, Godfrey and Dave, the people that you hired about a year back or so, rather than the ones that you hired six months back -- a year and half back or so. What is the trend in productivity? Are you seeing an improvement in productivity and quicker ability to close million dollar-plus deals? And have a follow-up question. Thank you.

Hi, Kash, this is Dave. When we look at productivity, it's been pretty consistent in terms of ramp time. And of course, we're talking about averages. But when you look at the expansion into what we call green zones were we haven't had any coverage, those typically are much longer than if we're adding a person into a previously staffed territory that we may be splitting because there's so much demand and pre-existing pipe. So I think we'll look at the overall productivity metrics and they may start inching forward once we get more critical mass from a geographic perspective.

Got it. And also $20 million deal that you talked about, I noticed that your long-term deferred revenues went up pretty significantly. Dave, any feel for how much of that is actually licensed? And over what timeframe do you expect to recognize this contract, granted that term licenses seem to be about 13% of your billings overall? I'm not sure how much it was. I think sequentially, it looks like a higher number -- just want to clarify that. That's it for me. Thank you.

Sure. Thanks for the questions, Kash. Term transactions were 13% for the quarter. And that was up from the prior quarter. But I'm trying to add emphasis that we have other types of transactions that are perpetual in nature. I was calling them early adoption arrangements. And the $20 million transaction fits that description. Those types of arrangements have a lifespan that is typically three years. And that's reflective in the long-term deferred revenue category. So when we talk about our term transactions versus our perpetual transactions that might have characteristics of term, the latter typically have three years of duration.

Got it. Thank you very much.

Peter Goldmacher with Cowen and Company.

Hi, guys. That $20 million deal was pretty spectacular. One of the big knocks on your business that Wall Street's talking about is how expensive the product is. But if somebody's spending $20 million on your product, they obviously see the ROI well beyond that $20 million. Can you talk a little bit about the justification your larger customers are going through, how they think about ROI? And if I spend $20 million, how much am I saving, not spending, replacing.

Yes. Hi, Peter. Thanks. Good question. Gosh. One of the most interesting things about Splunk is how many different ways we express ROI because a customer who takes us in in the security department is thinking about reputation defense as opposed to somebody in infrastructure whose thinking about better monitoring and understanding their scale-out of their infrastructure. So I'll just try to give you a short answer to a really hard and long question. It depends -- the answer is, it depends on who the primary owner is and in what department. If it turns out -- let's take this large customer. In the place that we were in probably 10 different departments, some of which are at massive scale, and we've become so integrated into the company that we're almost like an ERP for all their machine data. We -- every critical system they have is both touching Splunk and ingesting from sport. There's two way transfer of information.

So at some point, if you are that well integrated into the company, you're having less of a conversation about the ROI and more about how do you continue to improve content delivery, customer experience, overall infrastructure performance, security posture? It becomes a multidimensional conversation. And so I think that ROI tends to be a little less of a topic at that level and more about just the criticality of the expanding our usage across all those systems.

So -- but you know, we have customers who, just for infrastructure, have done case studies. You find them on our website where they saved $10 million to $15 million a year in capacity planning because they didn't have to forward buy hardware if Splunk is able to better monitor the hardware they have and showed them peak utilization in places where your -- you buy for continuous monitoring as opposed to peak performance. So ROI comes -- it depends on the economic buyer. It depends on the primary use case. But we feel pretty confident once we're in customers over a period of time that that becomes a more of a norm of the conversation as opposed to just a driven by a hard ROI conversation. Hope that's some help question.

Yes. That's a lot of help, Godfrey, because what I'm hearing you say is that it's not so much about rip this system out and do it better with Splunk. It's more about there are new opportunities that we see and it's probably a little bit more challenging for your sales guys because there's not -- doesn't sound like they're repeatable use cases. But it's the whole land-and-expand where people start with an idea, and then over time see the value. So the cost ceases to be an issue when the value is there. Am I paraphrasing what you said properly?

Will let me just try it one more time because this is a hard one. But what I would say is it is repeatable, but it's repeatable within the use case. So when we're in an application development or monitoring department, what we're talking to them about is improving your up time -- up to -- into the high 90s range from whatever it was. We're talking to them about being able to reduce the time to diagnose and fix problems by 90%-plus. We have very hard ROI metrics for app monitoring. We have very hard metrics for all the infrastructure and operations side around capacity planning and server utilization and hardware cost and all that. We have less hard ROI metrics around threat detection, around advanced persistent threat detection, but nobody else can do what we do. None of the SIMs can handle the kind of data volumes we have so there's really no -- we're so much cheaper than a SIM and so much easier to deploy and deliver value so much faster that we almost never compete on an ROI accept against the cost of the SIMs the customers don't like.

So it depends on the department as to what ROI is. But we have very definitive ROI cases in each of those. When we get to such a large presence in the account that they're buying an enterprise license agreement, it's because all the departments are saying we wanted to have a big license of Splunk and that tends to be a little less of an ROI discussion and more of a standardization discussion. We're talking about establishing Splunk centers for excellence. We're talking about how to -- doing data architecture with them. What data's important versus not. We give them much more specific help around how to do large-scale deployments and weaving the departments together. So in the latter cases, it's less about ROI and more about effectiveness. Is that better?

Yes. Very helpful. Thanks a lot.

They are repeatable. The ROI cases are repeatable at the department level.

Great. Thank you.

Don -- John to Fiji with JPMorgan.

Hi John

Hi, guys. Thanks a lot. Again, just repeat -- great job this quarter. I have a question. I think first question is for Godfrey and then a follow up for Dave. Godfrey, in a multi-year agreements, it's nice to see this commitment by customers -- this longer-term commitment. It shows that the long-term deferred really strong -- total billing's actually accelerated in the quarter from last quarter. Is this something you expect to continue? Is this like a trend that we -- that you would expect in your engagements -- I guess the current engagements that you're pursuing right now. Do you expect to see more and more of this?

Well that's what we aspire to do. So there's a part of me that just scratches my head and go well, Q4 is Q4 and Q1 is Q1. So metrics aren't -- don't always apply. You can't just literally translate Q4 metrics into a Q1. We all start the year over and start pushing that rock back up the hill. But we're really excited from the standpoint that customers who have had success with us from department to multi-department, there is a place where they come -- the light bulb goes on and they go, wow. Splunk is not just a department or multi-departmental solution anymore, it actually is the data fabric of all of our machine data and we're connecting it to our structured data, to our data warehouses, we're connecting it to our transactional systems, were connecting it to the rest of our security systems. It is interesting -- when they finally get the sort of data platform thing it's a -- we're having a very different conversation with the customers. And they're coming in and asking us. I was down in SoCal yesterday having a conversation with a customer and they said, can you just come in and do an overall enterprise-wide assessment for us? We have you in six different departments. We need for you to come in and just help us understand what's the -- how do we use Splunk at the enterprise level? How do we move from multi-departmental to wide-scale use where everybody is threaded together? And who should run that and how do you provide user access? I mean it turns into a very different conversation.

And that's what we aspire to be is to be the data platform. We want to be the platform for machine data for all of our customers worldwide. It just takes time and it takes effort and it takes driving projects success and we grow up and we get there. So I'm thrilled about the progress we're making and I hope that what we're shown as evidence here is what we can drive more of in the coming years.

John, let me pile on with just a couple numbers as it relates to -- is it a trend? For the first time we did talk about seven-figure transactions and, of course, we had a record number of six-figure transactions. That said, our ASP's were about 7% higher overall from the fourth quarter of last year to this year. So why is that was so many large transactions? Because the other part of the business that doesn't fit into those categories has been growing significantly as well. So as a percentage of our overall business, we're seeing more of these transactions but we're just seeing so many more transactions overall it's reflective in the ASP's.

Okay, great. Guys, that's helpful. So those smaller deals do turn into larger deals as you've talked about in the past too. But a follow-up, Dave, too, on that one $20 million order. You said it affected DSOs and you see it in the [pop] and AR -- accounts receivables. I'm just curious, are the payment terms unique for that deal or will we see that cash collected next quarter? Because cash flow was really strong this quarter. And it sounds like that's going to help in the future too -- that deal anyway. I'm just curious if it will be mostly next quarter.

Yes. The payment terms were routine. Nothing unusual about them, so I would expect to see it in the first quarter. And if you look back over the linearity of our cash flow on a quarterly basis, you'll see Q1 is very often a strong cash flow quarter for us. Q2 is less than Q1 and it balances out by the time we get to the end of the year.

Okay, great. Thanks again, guys. Nice job.

Thanks, John.

Brent Thill with UBS.

Good afternoon. Godfrey, the RSA show, you had a packed booth. And I'm just curious if you can give us a sense of what you're seeing on your security pipeline and, perhaps, how that spread is helping you on follow-ons from the security side. I believe last quarter you said it's about 30% of your deal flow. Any color would be helpful. Thank you.

Hi, Brent. So, yes, we had just a phenomenal turnout at RSA. The booth was just packed. And if you judge success by how many T-shirts we gave away, it's a pretty positive show.

They were out of the XLs.

I know. I believe it. And it takes the SH out of IT is the one that runs out first. So we're having to modify our inventory mix a little bit.

So on this security market, so it still runs typically 25% to 30% of bookings in any given quarter. It's pretty consistent. What's really changing, and if you saw some of those panels and saw some of the press reports out of the RSA show, this was the first year where they're finally calling BS on these SIMs. They're just basically saying, hey, we trumpeted these things for a long time and now we're seeing customer frustration. We're seeing how these rules engines built on top of relational databases, they take a long time to stand up. They're only designed to deal with known threats. Because it's an RDB underneath, it can't handle these massive, and varying data. The data volumes and the variety of data, you can't change them, they're inflexible. Anyway, we're just -- the customer frustration over this -- these things is finally starting to spill out. And the one company that tends to get some positive mojo out of this whole thing has been Splunk and not because we're a security expert but because of the nature of the Splunk technology is such that we can handle all of these different data formats. We can give security practitioners an easy user interface to go in and search and look for anomalies for statistical anomalies for new threats, different patterns. It's more these days with APTs. It's more in the math than it is in the rules. And so that's where Splunk is really getting some recognition now.

So this was an interesting RSA show for us because it was kind of like Splunk's coming out party. And I'm not sure we meant it that way as much is the rest of the market kind of had a realization moment and is finally started to get that there is this sort of old generation and there's the new generation and Splunk is absolutely in a leading position to define the next generation of the security market. And we plan to do that. We have a responsibility here and we'll take it.

Thanks, Godfrey.

You're welcome. Thank you, Brent.

Brendan Barnicle with Pacific Crest Securities.

Question -- you talked about the security use case going up to about 25% to 30% of bookings. Can you give us a breakdown on the other use cases? Have you saw any change there from what you've seen in the last couple quarters?

Right. So thanks. It was pretty consistent. So I always think about the whole app monitoring business being about [app dev], app monitoring, app management, that whole thing being about 30% -- infrastructure, operations, network, the whole thing -- think the org chart of a VP of IT Ops. Everything in that world would be another 30 -- what's underneath the [seeso] would be probably that 25%-ish, give or take. You get into compliance, it's probably more like a 5%. And there's a long tail after that, which is business analytics, web intelligence, some industrial data. We saw interesting new use cases this quarter with industrial data. So all interesting patterns, but the ratios were pretty constant in Q4 with what we saw in earlier quarters in the year. I said there was anything that was, and you're talking like a percentage point or two, we started to see some of these non-IT use cases like industrial data and web data coming up a little bit.

Great. And then in the last couple quarters you've talked about the new apps. I think last quarter you announced -- I think 45 new apps in Q3. Any update on the apps growth?

Gosh. I actually don't remember what the number of new apps is on Splunk base of for Q4 but it's in that range. It's pretty -- we see typically 10 to 15 new apps every month. So it's kind of like in that range. There's just a steady set of contributions from the customers. But you know -- very encourage there and love what we see. So it's all good.

Great. And then one quick one just for you, Dave. As we think about seeing more deferred revenue, in particular, this long-term deferred revenue, are you starting to think any differently about the visibility you have into the model and into the guidance?

Yes. I mean we obviously spent a bunch of time on it. But we still have some pretty big variables that are hard to predict, which I referred to in the prepared remarks around term-mix has ranged from 10% to 20%. And when we get into these larger transactions, in particular, we'll see the adoption treatment that translates into ratable recognition. So we consider all that in our model. But they're fairly large contributors on a difficult to predict basis. As we start to develop trends that are maybe tighter in terms of percentage of the business or how their flowing then we'll certainly update the guidance appropriate way.

Terrific. Thanks guys.

Thanks, Brandon.

Adam Holt with Morgan Stanley.

The long-term deferred number was well ahead of our model, more so than just years two and three for one large deal. Is it safe to assume that you have multiple multi-year deals? And are you doing anything in the sales organization to incent those longer-term deals?

Hi, Adam. It's a good question. So we mentioned we have 11 seven-figure transactions in the fourth quarter alone. And certainly more than just the one $20 million deal had multiple years associated to them, which is reflected in the long-term deferred. Interestingly, we haven't been incenting the sales force. The sales force is effectively neutral for the most part between typical perpetual type transaction, the term transaction, are ultimately what becomes a multi-year perpetual ratable transaction. So we're spending a lot of time about that. For us, it's about the customer. Like how do we set the customer up for success? We want to reward the guys for delivering on customer success in their sales comp. So that's our motive. And that's how we're going to continue to operate in terms of sales comp.

Got it. And just quickly on the capacity, you mentioned in your prepared comments that we should be thinking about a longer-term ramp than some companies. Looking at when you added the capacity through the year, it still looks like you should have some upper pressure in the second half of the upcoming year. Is that the right way of thinking about the ramp time and the heads that you've added? Thanks.

Sure, Adam. Thanks. Certainly if you look at the ramp of additions over the course of fiscal '13, we expect to see contributions from those folks in the second half of '14. Of course, given our particular model, and if you start looking out one quarter, two quarter, three quarters -- what's the mix going to be, whether it be the term deals or the perpetual transactions? So we expect the productivity to kick in in that period of time, for sure. And as we get there, we'll guide you guys appropriately.

Great. Thank you.

Thanks, Adam.

Brian White with Topeka.

Hi, Godfrey. Just on China, you had a couple good wins in China with GOME and China Construction. Could you maybe talk about how important China is to Splunk and what you're seeing there, generally? And secondly, Storm -- maybe talk about the customer profile and some of the traction you are seeing with Storm. Thank you.

Great. Thanks for the question. So on China, I would say -- let me give you a little bit of context on Asia. Over the last couple of years we were into country expansion mode and we typically, as we hired a couple extra people out there, we would drop in and open up a new country. And so we did that -- in fact you can think of calendar 2011 as the year we did that. In 2012, we kind of slowed down country expansion and started trying to put people -- more people on the ground in country. So we went from two people in Japan to a handful of people in Japan. And that was a really good thing for us because when you have it serve as many markets as we do, you have the challenge of only one salesperson and [SC] in a country can't know all the use cases. They can't cover all the customers, on and on. So we try to get -- drop in multiple teams so that we can have some expertise with people from a background of the security market. And the next team will try to have backgrounds from application side or from infrastructure and the like. So we're trying to diversify the backgrounds and skill sets of our people as we go into country.

So think about that and if you were out by yourself an Asian and somebody dropped you into China, you'd just look around ago, oh my God, what do I do next? And so we're -- that's kind of where we are in China is we have a -- some -- we have a handful of resources on the ground, nothing to sufficiently cover the market, and they're absolutely in startup mode. So what they're doing right now is working closely to develop a partner channel and their opportunistically going after customers who respond to us. There will come a day when we are a more proactive presence there. But I would say we're absolutely at the starting line in terms of that particular country. It's one of the last that we've been able to get -- to have the maturity of the infrastructure to go in. Switching -- so hopefully that answers your question. We're just at the starting gate on China. It is important to us, but we will invest prudently there like we do everywhere else.

On to storm. So we had about -- we have about 160 customers now and about 200 projects and a profile that those customers is very much developers. So when we originally built Storm, our target was developers. And what does everybody do now? They all sort of bypass IT because nobody wants to wait for IT to approve standing up a rack of servers and infrastructure and security and all that stuff, storage. And they just go up to Heroku or they go up to Amazon and they dial-up some capacity and they start programming. And when their project is done they either -- it succeeds and the bring it on PREM or they deploy it in the cloud or they shut it off. But they want flexible infrastructure and that's why that's one of the core use cases of the cloud. So our strategy with Storm was to build the user interfaces and the way it works to specifically go after developers. And we are. And that's who typically -- their infrastructure is in the cloud. It's typically in Amazon. So because they're app that they're developing in their infrastructure is in the cloud, it's really easy just to connect that infrastructure to Storm and it is working pretty well.

I'd say that the one thing that's a little different about Q4 compared to Q3 -- so Q3 was our first quarter ever with Storm, Q4 was our second quarter live. And the one thing that was kind of interesting was to start to see some of our corporate customers, our Splunk Enterprise customers like Electronic Arts, they're using us on PREM pretty heavily and their developers -- guess what -- they're not on PREM. They went up to Amazon and started a new game and developing some apps up on the cloud. So those guys found that Storm was a perfect tool for them because they could turn it on and easily match it to their development environments.

So I guess if there was one interesting tidbit about the profile of Storm customers in Q2, it was that we started seeing some of our Enterprise customers development department using Storm in addition to them using Enterprise on PREM. So that's good for us to.

Got it. Great. Thank you.

We have time for one more question. That question comes from Raimo Lenschow with Barclays.

Thanks for taking my question and congratulations, again, as well for me. Just to talk a little bit about scaling the business -- first, can you talk a little bit about what's doing on the partner SI side in terms of how they are reacting and if they are going to be any help going forward. And then the other thing is on scaling -- if you talk about 250 people getting hired this year, that's about -- that's the number as last year. But should you not started scaling a bit faster, given that the base case is getting bigger? Thanks.

Hi, Raimo. Thanks for the call. And thanks for the invitation to your conference last week. On the scaling piece, we actually hired more people last year than we had in our plan. And as we kind of go through the year, if we have additional upside in the plan, we hire more people. So part of it is a budgeting exercise where you try to build your envelope and managed to it responsibly. And if we can hire more people this coming year than what's in our plan, we will. But we won't know that until we execute on a quarter-by-quarter basis. And I have to tell you, the number one strain in the Splunk organization -- going from 250 -- sorry going from 450 to 750 in a year is a significant amount of stress on the organization because of the number of new people that we're trying to train and bring on board. I'll actually welcome having just a little bit smaller percentage gain in employee base this year so that the folks who have gone through the ramping over year can kind of help us ramp the new people.

But that's -- it's still one of our biggest organizational challenges is just -- is bringing people on and teaching them a business that's very different than anything they've done before. Splunk is so different -- you could have sold or developed or you could've done something else to life -- marketed, enterprise software somewhere else -- and you kind of have to forget most of what you've learned and come in and start all over again with Splunk. So it's still a big resource challenge for us. So far so good, but that's the one place where we try to do it right the first time. Anyway, Dave, did you have anything to add to that?

I think that's right. There's -- even with 250 last year, as Godfrey mentioned, we started the year with less than 500. Even looking at 730 when we start this year -- adding 250 is a lot of throughput for what is relatively a small Company overall. So we really care most about quality versus quantity. And that puts constraints on our hiring capacity. And you know we're -- we certainly could add more but we do want to do so at the expense of making sure we get the best.

The one thing that could crush us would be high turnover. At the rate we're growing, if you factor in a high turnover amount, you just change all the metrics. Every metric we have goes out the window. So keeping turnover low and keeping quality high is just job-one around here.

Perfect. Thank you. On services -- on partners -- do you see anything there?

Oh, sorry. We continue to see the partner percentage of our business continues to creep up by a couple percentage points every year. And I believe globally this year -- Dave, it was about 30% of our total revenues went through partners. In Q4. Sorry in Q4. 30%. So that's a continually upward trajectory for us. Those -- it's much higher than that in international markets and a little lower than that in domestic markets. But all of those numbers are still heading north. So partners are a really important part of our business and will be for as far out as I can see.

Perfect. Thank you.

Thanks a lot.

The does conclude the question-and-answer session. I'd like to turn the call back to Ken Tinsley for any closing statements.

Great. Bethany, thanks very much for your help tonight. I appreciated it. And thanks for everyone for joining us tonight. I hope you have a good evening. If you have any questions we're available. Reach out to us directly. Thank you.

Ladies and gentlemen, this does conclude your conference. You may all disconnect and have a good day.