Splunk Inc (SPLK) 2014 Q1 法說會逐字稿

Good day, ladies and gentlemen, and thank you for standing by and welcome to the Splunk Incorporated's first-quarter 2014 financial results conference call. At this time, all participants are in a listen-only mode. Later, we'll conduct a question-and-answer session and instructions will follow at that time.

(Operator Instructions)

As a reminder, today's conference may be recorded.

It's now my pleasure to turn the floor over to Ken Tinsley. Sir, the floor is yours.

Great. Thank you, Huey, we appreciate that and good afternoon, everybody. With me on the call today are Splunk CEO Godfrey Sullivan; and CFO Dave Conte. Just a heads up, we've had a power disruption to the building today, so if we drop off we'll dial right back in.

As a reminder, today's conference call is being broadcast live via webcast. In addition, a replay of the call will be available on our website following the conclusion of the call.

By now you should have received a copy of our press release which was distributed this afternoon. If you have not, it is available on the Investor Relations section of our website.

I'd like to remind you today that during today's call we will be making forward-looking statements, including our guidance for our second quarter and full fiscal year 2014, expanded use of our software by our existing customers, the size of license purchases, our investments and product enhancements. We caution you that such statements reflect our best judgment based on factors currently known to us and that actual events or results could differ materially.

Please refer to the documents we file from time to time with the SEC including the 8-K filed with today's press release. Those documents contain important risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements today.

Forward-looking statements are made today based on facts known to us. If the call is replayed at a future date, the information presented during this call today may not contain current or accurate information. Splunk disclaims any obligation to update or revise any forward-looking statements to reflect events that occur or circumstances that exist after today. We will provide guidance on today's call, but will not provide any further guidance or updates on our performance during the quarter, unless we do so in a public forum.

During the call we will also discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of the GAAP to non-GAAP results is provided in today's press release and on the Investor Relations section of our website. The projections regarding our non-GAAP operating margin today that we provide exclude stock-based compensation expense and payroll taxes related to employee stock transactions which cannot be determined at this time and are, therefore, not reconciled in today's press release.

So with that, let me turn it over to Godfrey.

Thank you, Ken. I always hope that that disclaimer introduction will get better, and it just doesn't. (laughter)

Hi, everyone, and welcome to the call. We're off to a strong start in Q1. Revenue for our fiscal first quarter was $57.2 million, up 54% compared to Q1 last year. License revenue was $36.2 million, up 48% compared to Q1 last year.

We added more than 350 new customers. New and upgrade customers in Q1 include the Bank of New York Mellon, Level 3 Communications, the State of Texas Health and Human Services, Nordstrom, the Bank of New Zealand and Winn-Dixie. Thanks to all of our customers around the world for their ongoing encouragement and support.

I spent a lot of time on the road in Q1 with trips to APAC, Europe and around the US. I probably had 50 individual customer meetings during that period, mostly related to our core markets but also some interesting activities in the world of mobile and the Internet of Things.

The biggest change, a year ago we were meeting with departmental managers and our champions. This year most of the meetings are at the CTO, CIO or VP of engineering level as Splunk is expanding from core IT to mission-critical operational analytics.

A few examples. In Hong Kong, an online gaming company is using Splunk not only for core IT use cases of authentication, device behavior and security, but they're also using Splunk to analyze how users are arbitraging their online betting with sub-second trading patterns.

Another example. We met in Europe with the C level team of an auto manufacturer who's using Splunk to analyze the output of their electric cars. They're already Splunking the cars' charging information and operational health. Their goal now is to provide the driver with interactive information on-screen so the driver knows where the nearest charging stations are located and ultimately to provide an online marketplace where restaurants and movie theaters can promote their destination with a recharge as part of the offering.

Another example in Europe is a wireless telephone carrier that is using Splunk to track their customers via wireless routers. These days the routers are only 50 to 100 yards apart so they can see 50,000 customers at a soccer match and then, through a time-based geoanalysis, understand where those customers went after the game, what towns, what bars, what highways they took.

The opportunity is to link companies together with this data to create mobile offerings. Every telco I visited is thinking about how to use their machine data to create a competitive advantage and a better customer experience.

Domestically, iRhythm, a medical device company, is using Splunk software to index data from their devices to understand how patients use them, to identify potential manufacturing defects and ensure regulatory compliance. McKenney's, a building automation company, is using Splunk to help Belgium Air Force base take data from 20,000 building sensors to analyze energy usage and reduce energy costs.

So while our core business still tends to be related to improving security and performance of applications and IT infrastructure, we see more companies combining that data with mobile data, device data and structured data to create a better customer experience and a competitive advantage.

A few comments about markets. IT operations was again above 30% of our total business in Q1. A few of our new customers choosing Splunk for IT ops this quarter included the Arizona DOT, the US Department of Energy, the Ministry of Presidential Affairs in Abu Dhabi and my alma mater, Baylor University in Texas. Baylor will rely on Splunk for centralized logging, real-time analysis and an understanding of what's happening across their IT systems and infrastructure and, of course, also to proactively identify unknown threats and network anomalies.

In a recent report on the IT operations market, Gartner mentioned that, quote, Splunk's value proposition has moved it squarely into this market, resonating with IT managers that are required to turn complex log files, events, metrics and alerts into visualization tools, unquote. In the report, Gartner mentions Splunk as one of the fastest growing new generation of IT operations management market vendors, referring to Splunk as a platform that is taking market share away from the big four.

In the security market, we're seeing more validation that traditional SIEMs are no longer adequate for today's cyber security threats. Companies need solutions that are capable of ingesting massive streams of diverse data and performing analytics on that data.

Gartner's most recent Magic Quadrant report places Splunk squarely in the leaders quadrant. That recognition is a clear reflection of the changing requirements of the security market from static reporting to real-time statistical analysis. Gartner also named Splunk as the fastest growing security vendor in their 2012 security market share report.

In addition, we're proud that the readers of SC Magazine awarded Splunk the best SIEM solution in the US and the best enterprise security solution in Europe. Customers selecting Splunk in Q1 for security included the NASA Johnson Space Center, Nomura Securities, Orange France, Arizona State University and NCG Banco.

NCG Banco, a European financial institution with 3 million customers in Spain and beyond, significantly expanded their use of Splunk for security. The bank initially selected us as a SIEM to correlate logs from all their perimeter devices. Now, Splunk Enterprise is their security intelligence platform for global fraud monitoring. The bank now tracks all money movement, transactions from ATMs, e-banking, branch offices and internal applications and then correlates and analyzes that movement as a part of their fraud detection system.

This quarter, one of our largest orders is a new customer, a large domestic bank. Our champion had come from another large bank, a Splunk customer. He had had a successful relationship with Splunk at his previous company and, therefore, one of the first things he did coming on board was to bring Splunk into his new role. Proven customer success and it drives more customer success.

To expand our market coverage, we continue to invest in apps and content. There are now more than 400 apps and add-ons available on Splunk base. This past quarter, we introduced new versions of the Splunk app for Enterprise Security and an app for Palo Alto Networks. A new partner developed app is Box for Splunk. This app indexes machine data from Box to track and understand metrics such as most active users, the most read files or folders and other trends based on organization's usage of Box's service. Another long-time partner, Sideview is selling an app on Splunk base for Shoretel that enables users to intuitively browse and report on their call records generated by Shoretel telephone systems.

Content like these apps and templates continue to help us close business, such as the Bank of New York Mellon, where the Splunk app for Microsoft Exchange was a primary driver for their purchase. For our Hadoop users, we released the latest version of the Splunk app for HadoopOps which provides real-time end-to-end monitoring, analysis and troubleshooting of Hadoop clusters.

We also recently announced partnerships with two of the leading Hadoop distributions, Cloudera and Hortonworks. These relationships are driven by our customers' need to use Splunk to collect, monitor, alert and analyze their machine data, and then in some cases use Hadoop for low cost batch storage and additional batch analytics.

Now, onto the cloud. We now have more than 200 paying customers on Splunk Storm which represents more than 40% growth over the prior quarter.

One notable example of a Storm customer is RevMob, a leading ad network for mobile app developers. RevMob is sending 250 gigs of data Storm from their cloud production environment. RevMob needed a centralized platform for analyzing their machine data but preferred a service offering to an on-prem solution.

We also now see customers using Storm like the SaaS version of our free download. They test their use cases in the cloud and then they go on to purchase Splunk Enterprise for on-prem deployments.

An example of this is InstantCab, a company that matches people who need a ride to cabs that are near them. Basically InstantCab allows you to see the cabs, book a cab, track it on its way to you and then pay for it automatically through their app. They have over 1,000 drivers in San Francisco and are providing tens of thousands of rides every month. InstantCab started with Splunk Storm in a dev test environment and then moved on with Splunk Enterprise to an enterprise license.

While our SaaS business is still in the early innings, we're continuing to invest in building out the team. This past quarter, we brought on two highly experienced executives to head our cloud Dev and cloud Ops teams. We'll continue to invest in a seamless customer experience which enables customers to use Splunk in whatever way makes most sense for their specific needs, on-prem, in the cloud or in a combination environment.

And I also want to say it was great to see many of you at our Splunk Live events recently with over 400 customers each in London and New York City and more than 750 in Washington, D.C. I really appreciate all of you taking the time to learn about our business and I especially thank our customers for their compelling presentations at these events.

Before I turn it over to Dave, I want to extend a warm Splunk welcome to Patty Morrison, who's joined the Splunk Board of Directors. Patty is an Executive Vice President of customer care, shared services and Chief Information Officer for Cardinal Health and she's a great addition to our Board. Thanks again and over to Dave.

Thanks, Godfrey, and good afternoon, everyone. Q1 was a solid quarter for Splunk against a difficult macro environment for software and we're pleased with our results.

As Godfrey mentioned, first-quarter revenue was $57.2 million, a 54% increase over Q1 of last year. And license revenue grew 48%, totaling $36.2 million for the quarter. These results represent the second highest quarterly revenue amounts in our history, following our recent Q4 performance, and reflect the continued value we're providing our customers.

In Q1, we added more than 350 new customers, two of which were the largest orders closed in the period. Overall, we recorded 132 orders greater than $100,000 compared to 73 in Q1 of last year. Q1 was also one of our largest quarters in terms of the total number of transactions. Overall, ASPs have ranged consistently between $30,000 and $40,000 over the last three years including Q1 as large orders and total order volume have grown proportionately. Collectively, these results reflect the continued momentum we've experienced as more and more enterprises adopt our software and expand its use across their organizations.

As Godfrey described, our customers consume Splunk software across a broad set of use cases. Our core market segments of IT operations, applications management and security continue to represent about 90% of our quarterly business, with each trending at about 30% over time. We're seeing this type of use case breadth not just in the US markets but globally as well, and the investments we've been making in field coverage are making an impact.

In Q1, international operations represented approximately 21% of total revenue, up from 19% last Q1. All three geos grew significantly year over year, with APAC nearly doubling its contribution and EMEA posting a 74% increase.

Importantly, we continue to leverage our expanding partner ecosystem to reach customers in regions where we don't have feet on the ground. In the first quarter, about 35% of our business worldwide involved our partners.

On the direct side, we continue to increase our field coverage and we ended the quarter with 174 quota carriers, up 11 net from Q4 and representing a growth rate consistent with our historic first-quarter trends. Outside quota carriers continue to represent about two-thirds of our direct team and inside, one-third.

Overall, about 50% of our direct quota-carrying team has reached full productivity as of the end of Q1. To reiterate, we continue to direct investments into both our own global field coverage as well as our partner ecosystem and I'm pleased with how we're performing in these areas.

In terms of bookings composition, our mix between term and perpetual license transactions was consistent with our expectations, with term representing 16% of Q1 license bookings. As I've described, we don't differentiate by license type when compensating our field teams. Rather, we look to enable customers to use our software based on their own buying preferences. As such, we expect term license arrangements to continue to fluctuate between 10% and 20% of any quarter's license business.

I've described on our last few calls that we also book what I call enterprise adoption arrangements which can contain provisions which require them to be deferred and treated ratably. These types of transactions are typically larger orders, in the seven figure category, and are designed to enable broad adoption of Splunk across an enterprise. We typically see these types of transactions in the second half of the year, just as we did in Q4. The level of EAAs recorded in Q1 is consistent with our expectations.

Just to re-emphasize, we expect to see continued variability, not only in the mix of term and perpetual licenses, but also the number and timing of enterprise adoption arrangements in the future.

Our maintenance renewal rate increased to 93% in Q1, our fourth consecutive quarter where renewals exceeded 90%. As I've mentioned, we've built a dedicated renewal team which now totals 11 of the 174 total quota carriers, double the number from last year. Customers also continue to leverage our professional services and educational offerings which together represented 6% of revenue in Q1, in line with our past levels of 5% to 10%.

Recall, the following non-GAAP operating metrics exclude non-cash stock-based compensation as well as employer payroll tax expenses related to employee stock plans. Q1 overall non-GAAP gross margin was 90%, in line with prior quarters. And gross margin on services, which includes support, maintenance, professional services and education, was about 70%, also consistent with prior periods. Non-GAAP operating loss was $5.3 million for the quarter, or a negative 9.2% of total revenue. Non-GAAP net loss for the quarter was $5.7 million or $0.06 per share using a weighted average share count of approximately 102 million shares.

DSOs were within our expectations at 59 days for Q1, while cash flow from operations was $19.9 million and free cash flow was $18.6 million. We ended the quarter with over $330 million in cash.

We'll continue to run the business on a positive operating cash flow basis and expect quarterly cash flows to fluctuate consistent with prior years, with Q1 and Q4 being our largest operating cash flow periods. Also, we expect to increase our capital expenditures over the next six to 12 months as we expand our global facilities to support our increasing employee base, as well as expand our cloud infrastructure, consistent with our growing cloud customer base.

We expect Q2 total revenue to be between $61 million and $63 million, with license revenue contributing about two-thirds of the total. Going into this year, we had expected between $260 million and $270 million in total fiscal 2014 revenue. With our Q1 performance and Q2 outlook, we now expect full-year revenue will be between $266 million and $274 million. Consistent with our prior guidance and investment philosophy, we will also continue to invest in field operations and product development at a rapid but controlled pace. When combined with our revenue plan, we expect Q2 non-GAAP operating margin to range between a negative 4% and a negative 6%, accreting gradually in Q3, then turning positive in Q4. We still expect full year non-GAAP operating margin to be roughly breakeven.

In addition to the continued field investment I've mentioned, we're also continuing to invest in our products. Our customers' success to date has been the result of great products and we're committed to extending and expanding the way our customers use Splunk as well as providing them the preferred delivery methods. As Godfrey mentioned, we now have more than 200 customers using our Storm product and we expect to have a greater number of use cases in the future, where customers access Splunk in the cloud. We'll update you more as that part of the business continues gaining momentum.

Overall, I'm pleased with our Q1 results, appreciate all your time and now welcome your questions.

Thank you, sir.

(Operator Instructions)

Kash Rangan, Merrill Lynch.

Good start to the fiscal year and good results, considering what has happened in software the last few months. One observation that I had for you, Godfrey, was I think on the earlier conference call you said that you intend to finish this year at a 33% growth in sales capacity. When I look at this quarter, you've grown quota-carrying sales capacity about a 70% clip. Are you re-evaluating your earlier decision to slow down sales hiring and is it possible that you might actually move your sales hiring targets up in lieu of how you accomplished in this quarter?

And secondly, if you could also talk about what are you doing differently this fiscal year from a go-to-market standpoint, increasing specialization of the sales force, and are you going to be targeting your opportunities? That will be great, thank you very much.

Hi, Kash, probably don't expect to change our projected outlook in terms of hiring. It's always better to front end load the field capacity as opposed to back end load. The one thing we've learned is that it takes folks a full six to 12 months and sometimes longer just to ramp. As Dave said, about half of our sales force we consider ramped at this point in time. So a big challenge for us right now is just training and ramping and getting everyone up to speed. So I think that's probably the biggest issue.

We are investing more heavily in the field this year in specialized resources, so it's a very timely question. We have created a security team in the field that has both -- we have a VP in the marketing organization who is our VP of security markets, plus our CCO as well as a dedicated set of security leaders in the field because that portion of the business requires specialized expertise. I can see us mimicking that model in other market segments as time goes on. It's a requirement to map up to the domain expertise in those markets.

Kash, is that okay? Have you got what you need there?

Yes, we're all set. Thank you so much. I thought I was being cut out, thank you.

John DiFucci, JPMorgan.

Dave, you said it was a difficult macro environment and certainly was, we saw a lot of companies put up numbers that were -- reflected that and Q1 definitely was tough for everybody. But your quarter here looks good.

But there's one thing here, the billings were a bit below what we were looking for. Was there any areas, both Godfrey and Dave, that were more challenging in the quarter than you thought they might have been? And Dave, was there any foreign exchange impact on deferred revenue? Because deferred was a little lower than what we thought it would be.

Yes, hi, John. In terms of geo pressure and you're right, and I mentioned it in my prepared statements, the software sector overall, I think, had a challenging period and not so much for us. We were pretty consistently strong across the three major geos. If there was one area where the predictability and the uncertainty is certainly still present, it's in the public sector and particularly the Federal Government. But overall, we saw strength across the board.

Okay, great. And was there any foreign exchange impact on deferred revenue?

No, our foreign exchange amounts, I think, for the quarter were less than--

Pretty small.

Yes, it was less than $100,000, which you can see in the other income/expense category. That combined with our international tax, you can see it below the operating margin line. So it was pretty small.

Deferred revenue for the quarter grew year over year -- from Q4 sequentially, even though we obviously came in on top of our prior guidance.

Yes and if I could, just one more. Dave, you mentioned maintenance renewal rates, 93%, that's actually great to hear. And you mentioned 11 people on your renewals team. Are the other field reps still getting paid on renewals, any commissions on the renewals, or have you transferred this entirely to the renewals team?

I would say it is a majority now transferred, John. There are pockets in across the globe where we don't have dedicated resources that we still ask our direct field team to carry the burden for renewals. But a majority of the field is now segregated between new business, license and first year maintenance versus maintenance renewals.

Okay. Great. And -- okay that's --

And John, by the way, I knew you would like that.

That's great to hear and it's nice to see some results especially relative to what everybody else has done. So thanks a lot, guys.

Daniel Ives, FBR.

My question is can you talk about is there anecdotally changes that you're seeing with customers in terms of your solution and just the more adoption rates that you're seeing throughout verticals?

Probably the single call out for Q1 was this sea change in the security market. So we had a strong quarter in the security market.

I have to call that market a solution. When customers are attempting to improve their security posture or defend themselves against advanced persistent threats, they fully understand now that the old-fashioned SIEMs that were a ruled engine built on an RDV are simply not sufficient against -- defending against these ongoing attacks.

I had a CIO in our office a few weeks back, major $35 billion company, describing to me that basically what you read in the Mandiant Report, and it'll scare you to hear what's really going on. And they need and have a full-time team of a half a dozen people that are sitting there watching full-time attacks on their systems and they're using Splunk to spot those anomalies. These are very clever people.

And so we're just seeing that this security market is really moving off of yesterday's model of a ruled engine, to a model where you have to have the ability to do sophisticated statistics on large data sets. And so when you see us moved into the leaders Quadrant for Gartner, you see us getting product awards by SC Magazine, you see Gartner describing us as the fastest growing security vendor, et cetera, it's the same set of products we've had in the market for several years, it's Splunk Enterprise, plus our security app.

But the market's coming to us because of the need to be able to do free form analysis against large data sets. So that's just one example. You see I could give you example after example, market by market but I think the security one is a good call out because it's been such a noticeable change and you see it in the conferences and you see it in the press, you see it in the customers.

That's very insightful. Great job in a tough environment. Thanks.

Thanks, Daniel. And appreciate your work on the initiation piece as well.

Thanks.

Brian White, Topeka.

Could you talk a little bit about DB Connect? You announced it back in-- or released it back in March. Maybe walk through the reception so far and what are you trying to accomplish here in the database market and is it opening up new growth opportunities for Splunk?

Thanks for asking that question. I had a paragraph in the script and I took it out because my script was getting too long, but now you just gave me the chance to talk about it.

You're welcome.

So we went GA with the DB Connect app during Q1. In a very short period of time it had more than 5,000 downloads off of Splunk base. Our customers love it. And they're now using it to combine streaming event data with data that's held in a warehouse or relational table somewhere, or an Excel spreadsheet for that matter. So you see customers doing things like combining their -- matching up IP addresses and host IDs that are coming in to their website from who's downloading their contents or white papers, for example, and map that over to their sales force environment and know which customers of their top customers are visiting their site.

We see customers looking at -- everybody with online web, customer facing websites, anybody who's selling or high transaction volume on a dot-com environment. You want to be able to take those logs and correlate them against a relational database or a warehouse to know which customers are they, what products are they looking at, multiply a product times a price and get real-time revenue on your website. It's all in the logs. But the ability of DB Connect to connect that real-time streaming activity back to customers, products, SKUs and prices is just a compelling event. So it's like gone from GA to the most popular download just in a matter of 30 days.

That's fantastic. Thank you.

Brent Thill, UBS.

Godfrey, even the software companies that have done well in Q1 have said it's taken about 10% more perspiration to get these deals done. And clearly your results have been really good, relative to what we've seen as highlighted by some of my colleagues earlier. But I'm curious if you feel like when you dig down one layer deeper is the environment changed at all? Are you in such a unique position with the product and the pipeline that you're cutting through this headwind, if you will?

Yes, thanks, Brent. Well, it's nice to have such a highly differentiated product like Splunk, you feel grateful for it. But the down side of that is that we have different competitors in every market segment. So the guys we run into at app management are different than the ops guys, different than the security guys, different from the web intelligence guys, on and on. And so we see plenty of competition in the marketplace and I would agree with the other execs who have said there was 10% more perspiration involved in bringing the business across the line.

It's just -- you have to go fight for the budget. And any time budgets are tight and the macroeconomic environment is what it is, CapEx gets constrained, OpEx gets constrained, and you're fighting against everybody, not because you have necessarily a competitive product, but because you're fighting for scarce budget dollars. So, no, I would acknowledge that there was more perspiration involved and our -- I think brother [Schroeder] would agree with that.

Okay, thanks for the color. And Dave, a quick follow-up on the quota-carrying growth last year was over 70, did you update the growth rates you're thinking about for 2014? And also the big deal flow, you had a big deal in Q4, did you see any of those type of elephant contracts in Q1?

Yes, no, we did not have any $20 million transactions in the first quarter like we did in Q4. We did have 132 transactions greater than $100,000, which is our cut off point for the definition of large. So we're definitely seeing more volume in larger transactions. And I think it's commensurate with Godfrey's earlier point that what's different from a year ago is the level that we're having discussions at our customers and prospects has really elevated to the C level, the VP level, as you'd expect, they have a broader set of use cases that they look to deploy our product around.

In terms of what we're expecting in terms of sales force expansion and capacity, we haven't specifically quantified quota carriers for fiscal 2014. But you can expect that our headcount growth will be consistent in terms of absolute numbers with the prior year and will follow the line items of the P&L. So you'll see 50% to 60% of our revenue invested in sales and marketing. And the headcount will follow in that regard.

Great. Thanks.

Raimo Lenschow, Barclays.

Two quick questions and congrats on a great start to the year. The first one is going back to Brent's question, I just jumped off the Palo Alto call and we have a big debate at the moment that April got worse than March. And maybe you can -- I know you didn't see it and you still executed well, but have you any comments there in terms of how the linearity in the quarter played out? And then the question I asked a couple of quarters ago, and that's the dynamic between larger clients and deciding about ELA versus volume pricing and any update on that one. Thank you.

Sure. Well, gosh since our fiscal period is April 30 and not March 30, I know Palo Alto's on the same as us, but Q1 is always more back end loaded than other quarters because sales compensation plans for enterprise software are what they are, everybody drags every possible order across the line at the end of Q4. And if there's ever a time in the software business where the cupboards are bare and you have to rebuild the pipeline, it's Q1.

And so it's not all that surprising that you see some softness from companies this quarter. That part of it, I don't know, Q1 is Q1 in software. What was the second part of the question?

Linearity and volume pricing.

ELAs and volume pricing. Even though Q1 is Q1, we did in fact have some seven figure transactions that were enterprise agreements and get treated, deferred over time type transactions. Yes, there's still momentum in the business at the high end and we're making really good progress in terms of conversations with customers around arrangements with Splunk to give them lots of capacity to try new things and deploy in lots of new places. So I'm very encouraged by the pace of those conversations and the level at which we're having them.

Perfect. Thank you.

Brendan Barnicle, Pacific Crest Securities.

Dave, I wanted to follow up on a couple metrics I think you gave us in the Q&A on the last call. One was percentage of revenue from existing customers and then of that, that breakdown from expansions and upgrades. And then also last quarter you gave us this metric of around original purchase size over a three-year period, you said it had been up 4 times. Those -- are those trends all remaining the same?

Hi, Brendan. So the trend around how large the purchase size is or how many dollars they bring, or customer represents after their initial purchase, I'd have to refer back to our prior commentary. We haven't updated that analysis. At that time, when we're going through the Q&A, our analysis show that customers spend somewhere between 4.5 and 5 times the amount with Splunk in the three years following their initial purchase. So that -- again we'll update that probably on an annual basis because we like looking at the same customer base, the same sample size, to see what those trends are.

As it relates to upsell versus new versus upgrade and expansion, this quarter I had mentioned our two largest transactions were new customers. So our new customer percentage actually was higher than it had been in prior quarters. That said, upsells still represent over 50% of the business for Q1. That mix is still probably two-third expansion in terms of new use cases and one-third in terms of upgraded capacity.

Great. And then one for Godfrey, great momentum you guys are having on the app side now that you're over 400. Are you seeing more acceleration? I mean, it may play off some of the earlier commentary you had around an increasing adoption you're seeing in the security vertical. Are you seeing a standardization where it's an inflection point, or is this more of the same?

Well, I didn't see anything that was so different in Q1 that it's worth a call out to your question with a specific answer. But I would like to touch on this whole notion of apps and content up on Splunk base. The one -- one of our partners that I mentioned, Sideview, this is one of the first examples of where one of our partners is actually selling an app on Splunk base. So I really view this whole notion of content on top of the Splunk platform as a place that will ultimately drive an enormous amount of traction and further enterprise adoption.

That, to me, is really exciting. They're actually using the same free trial that we use with our download where you can try the product for an X amount of time and then buy it for I think it's $2,500 for a two-year subscription. And it's a good example where we want to encourage an ecosystem to build content on top of the Splunk engine and we want them to be financially successful off of it.

So just like we have a couple of pieces of content that we charge for, which is our enterprise security and PCI solutions, over time as things grow up from a template to a full scale app with product life cycle management and documentation and support and all that stuff, we'll see additional pieces of content that move from free into paid.

So I think this notion of more and more content and more valuable content, more fully developed and baked content is going to help us become a standard across enterprises as they realize that the indexing engine itself is a data platform and you can get enormous value in multiple departments.

I'll try to give you more color on that on the next call. But I don't have a specific story from Q1 about that other than sort of general momentum.

Great. Thanks a lot.

Phil Winslow, Credit Suisse.

This is Siti Panigrahi for Phil Winslow. Yes, congrats on a great quarter. Definitely impressive to see so many diverse use cases for Splunk. I was wondering if you could talk about competitive landscape and also dig a little bit more into your -- the cross-sell opportunity in the US as well as your strategy to expand into international markets?

Well, competitive landscape discussion can be quite lengthy because we have competitors in so many segments. So I'll try to over-simplify that and say in the security landscape, in security market, the landscape did not change much. Most of the places where we complement is when customers put us in next to a SIEM. There are other places where they're actually using Splunk to replace a SIEM or they're buying Splunk and never buying a SIEM. That's probably the place where the most noticeable shift is under way.

In the whole area of infrastructure, it was business as usual. There was -- the competitors are all still the same. There was nothing much that changed there. Not too much in the app management space. But there was a fun call out, it was when did our -- for those of you who had a chance to attend our Splunk Live in Washington, D.C. at the Reagan Center where it was packed out, 750 people, you also saw for the first time we had about 10 partner exhibitors there, showing the solutions that they're building on top of Splunk and most of those were in the app management or infrastructure use cases. So actually think we're gaining some traction there in terms of building an ecosystem around us in that category.

And then the other place where it was the most noticeable change for me personally in the quarter was the number of conversations that I had, a lot of it was in the script, the number of conversations I had in the quarter with executives about non-IT use cases where they combine IT data that we already have in Splunk with device generator or mobile generated data that has to do with their customer analytics or business analytics.

To me, that's the one that's just really a change from a year ago. And that's not so much competitive dynamic as it is a new set of use cases coming up.

That's great. Thank you.

They might have used -- in the past that might have been -- it sounded an awful lot like the old BI conversations I used to have in iPierian days where they're really asking questions around changes in customer behavior, product velocity, all that sort of thing. But now the product velocity and the customer behavior is coming from mobile devices, it's coming from websites, it's coming from streaming event information and so they're asking what you think what sound like BI questions, but it's actually operational analytics off of machine data.

Sorry, next question. Sorry that took so long, fun stuff.

Peter Goldmacher, Cowen and Company.

I want to talk about your last comment because this is the first call you got -- you've hosted where I think the majority of your use cases were beyond the traditional IT operations use case. And it seems to me as you move out beyond IT operations, your total addressable market expands pretty dramatically. And that presents its own unique challenges as perhaps you need to reorient the sales force to go after vertical opportunities and go after specific industries. So what -- I'd like to hear a couple things.

One is of your nontraditional IT use cases, are they coming from customers that already exist using your product in IT operations, they gain familiarity and then they see opportunities beyond IT? Or is it a whole new category of customer that their first-time use is something non-IT? And as you build out your three-year plan how do you intend to approach that opportunity? And my bonus question is how are you going to think about the business on-premise versus on-demand as you grow into the future?

Okay. Gosh, I'm going to probably take a subset swing at that with an example and see how many of those questions I can click off with an example. So when I was in Europe, I met with probably in a span of a two-week travel period, I probably met with four or five major telco customers and the conversations sounded like, Splunk, we love you guys for IT operations, we've had good success with you. We have you in three or four different departments, we're up to a terabyte or two or some number like that, but we now see that we need to use you on a larger scale because we really need to analyze all the mobile data in order to understand customer analytics, changes over time, all that stuff. Oh, by the way, because these data volumes are so large, we've been throwing a lot of that stuff in Hadoop. And the only problem is, we can't get it back very easily.

And so I actually had one large telco on the continent call Hadoop they're data great and that's not meant to be a belittling remark but rather they understand it's like cold data, that's where you send data to rest.

And now they know they need analytical tools on top of it so that they can get real-time analytics from both the real-time streaming data off of their systems as well as data that's at rest or somewhere staged. And so they were asking us a very different set of questions. It wasn't a conversation around how does Splunk compare to some competitor in IT ops. The question was, Splunk, how do you see yourselves as a core part of our enterprise software architecture and what role do you play compared to the visualization guys, the open source batch storage guys, the OLTP transaction engine, how and where do you fit in that world?

Now, to your question -- so to your question now about all these different use cases, as when you get out into that world of industrial data, more and more that's the question they have. That where does Splunk fit in my enterprise software architecture because I have lots of other tools that I have applied against these use cases, often without very much success. They have the same headaches that the BI vendors used to have in terms of aggregating lots of data and it takes years before you ever get any analytics out of it.

So I see this as a very interesting time for us as we move from being an IT search vendor to operational intelligence in the category we've been trying to define and create, is actually starting to emerge, more and more people are writing about it, we're being invited into C level conversations and the like. So it poses challenges for us because the use cases tend to be very different, just like the operational side of BI has a lot of diversity to it.

Our -- what we have to do there is to do a really good job of explaining where is Splunk a fit and where is it not a fit. And I think we're getting better at that. We're seeing it because of all these diverse use cases. And then you can apply that to well, how do they want it delivered. The delivery is in these cases a secondary or tertiary concern. They're more concerned about solving the problem. And so that's that.

Let me pause there and say, did I get some of it or all of it or is there anything you want further discussion around?

That's a great answer, a really good story. One of the things I think about is the utility, part of the value of what you guys are able to do with Storm is create an enormous body of data. And so, there's typically a challenge for a company going from a traditional perpetual on-premise license to a software service delivery model with subscription but the benefits, there's real upside because of the data you get to work with.

And what I was trying to get a sense of is, how are you thinking about that transition? And what I heard you say was right now we're letting our customers decide and there is no Splunk preferred method, and I suppose that works for now but am I right to suspect that at some point down the line you're going to get a little more disciplined internally on on-premise versus software as a service model?

Okay. So let me take on cloud then as a specific topic as opposed to operational analytics and how -- and all the different ways that gets done.

If I had to give an observation on that, it would be that the questions customers are -- when a customer asks us to deliver them a service, they rarely say, Splunk, I'd like for you just to do generic logging for me in the cloud. That's rarely how the conversation goes. They say something that sounds much more like a solution and especially when you get to a CIO level.

They say, I'd like to have a security service where you're able to take data and the learnings from it and help me have a better security posture because of your learnings, what you get from looking across large data sets and working with lots of customers. And so that's a good example where I really believe that this, three years from now we'll be talking about the cloud as a series of solutions delivered as opposed to -- we've spent a lot of time today talking about Splunk as an analytical engine. In the cloud, we'll be talking a lot more about solutions delivered.

For example, we have 20 MSPs worldwide right now that are using Splunk as the engine to deliver managed services for security, including having signed up NTT in Japan in Q1. So we will have -- there are multiple ways to use a logging engine, an analytical engine like Splunk to deliver a SaaS based, a service based if you will, solution for customers. I've had customers say the same thing about PCI, about customer analytics, about this, but they never say oh, I just like to move my logging to the cloud. What they say is I'd like to get a solution to this problem and can you deliver it as a service? The hard answer to your question is we have to over the next few years as we evolve Storm and we evolve its architecture and we evolve its content and whatever else, is to determine which solutions do you want to deliver to customers so that you can do the same thing 1,000 times as opposed to one thing 1,000 -- 1,000 things one time you want to do -- you know what I mean. You've got to have a repeatable motion if you're going to offer a cloud service and I think that will look more like a solution and/or series of solutions delivered off of somewhat more predictable data sets.

When a Barclays presents -- yes, when a Barclays presents in London and says we're using multiple terabytes of Splunk data per day and we're feeding 430 data sources into it and we're doing enterprise level, et cetera, that's a pretty hard model to replicate in the cloud. So that's why I think you'll see smaller numbers of data sets, more focused types of feedback and reports back off of it. Let me stop there.

Yes, no -- so more of an application approach through Storm and more of an infrastructure approach through the on-premise stuff.

There you go. I wish I had said that up front, it'd save me a lot of time. (laughter)

Thanks a lot, guys.

Ed Maguire, CLSA.

I'd like to back up. Godfrey, last quarter you had thrown the gauntlet down and said that on the security segment you guys were -- you were starting to really take a lot of business away from point solutions and was wondering if you were seeing a similar trend play out in your other IT, either the application performance management or some of the web analytics side?

Well, so hi, Ed, thanks for the question. And I guess it has played out to a degree in Q1 on the security side as you see the number of awards we've gotten and market share reports and all that. I think we were justified in our commentary on that one. On the other segments, I don't have a story or a proof point or a claim to make that there's some huge shift going on, other than the shift that's been going on really for the last five years. Which is the move from point solutions, I've got my network monitoring tool, I've got my database monitoring tool, I've got all those point tools but I still can't find where the breakdown was or where the transaction failed. I would say it's business as usual in app management and IT operations where customers are finding that being able to put all the data in one place, that the place being Splunk Enterprise, is the new wave. It's still certainly working in our favor.

Great. And one follow up which is that if I look at the targets you've laid out for this year, you got hiring it seems to be running maybe ahead of pace. What, if any, constraints or gaiting factors do you see in continuing to scale the business, whether it's just operational or the condition of the macro markets or the pace of the ability of your customers and partners to digest and implement the software?

Yes, it's the latter. It just takes time. It's the old mythical man month in software development. You can apply nine people to the baby but that doesn't mean you'll have it in one month. It's a matter of it takes time to hire people, on-board them, get them productive, have them all working in harmony and paying close attention to customer requirements and being responsive. You have to be agile, but you have to stay focused. No I think it's the hardest part about our business when you're growing at our rate is trying to on-board both people, partners, software developers and so forth and keep moving at pace.

Great. Thanks very much.

Karl Keirstead, BMO Capital Markets.

David, I'm thinking through how this mix shift to enterprise adoption arrangements, as you call them, affect the financials. One obvious way is that your long-term DR got an uptick in 4Q. But I'm just thinking of other stuff. For instance, is there a portion, maybe you could remind us of these arrangements that are not yet billed that would create an unbilled backlog, and if so, if you could help size it? And if there's any other P&L or cash flow impacts of these arrangements that are worth calling out. Thank you.

Sure. Hi, thanks for the question. On a very infrequent basis, we might have a contract that has an extended billing cycle where we might bill annually or even quarterly, but those are very infrequent and de minimis overall. Obviously, when you look at the geography between deferred revenue and revenue you'll see it can fluctuate any quarter depending on the types of term mix that we'll see as well as the impact of these enterprise adoption arrangements. So in terms of any other elements of the balance sheet, the income statement from those, it's really that geographic mix and there's, again, very little that isn't billed at this point.

Okay. Thank you so much.

Keith Weiss, Morgan Stanley.

This is Sean Hazlett filling in for Keith. I wanted to go back, Godfrey, and revisit the topic of monetizing apps. And it sounds like you've introduced a number of apps this past quarter and you are charging for some of them. How do you see that going forward? For instance, how do you decide when to start charging and how do you monitor usage for apps that you haven't charged for yet?

Yes, so thanks. We actually internally -- externally we over use the term apps because it's easiest to describe content in that way. Internally we actually have three tiers. We have apps, a real app. We have templates and we have add-ons, which are almost like connectors or do something much more specific. We don't generally think about charging for templates now or probably ever because they're pretty thin, where it's like a macro for excel where you get a template that you would drop on top of excel and it helps you do income statements. But you wouldn't think about buying it. It's very helpful but probably not chargeable.

When templates go to full product life cycle management, where we have MRDs and PRDs and Dev teams working on it and we probably put work flow into it, in fact we have put work flow into it, and it's very specific around its functionality in order to meet some customer requirements, that's when it goes from a template to an app and that's when we start charging for it because it's something we have to maintain and continue to develop over time. Enterprise security and PCI are good examples of things that started as templates, worked into apps over time and now we -- they are significant in terms of their functionality and work flow and we charge for them.

I can see some of our templates that are currently free ultimately going to paid as they grow and mature. So I could see a day when for example our Microsoft exchange, our active directory, the Windows, pull all the Windows stuff into one environment, put a user interface on it, put work flow and notifications into it, put enough functionality into it where a customer feels like paying for it is a good value, I could see that kind of evolution. I could see the things in IT operations where you're combining multiple templates and having a more consolidated view. So we have work like that that's always under consideration. Not ready to announce anything and right now we're just trying to make sure we understand customers' needs and keep moving towards that. But yes, you'll see -- I wouldn't be surprised if next year that we have more content that has a price tag on it.

Okay, thank you. And then I have a quick second question. In terms of the sales force ramping you said -- you mentioned they were about 50% ramped. It takes 6 to 12 months for the average salesperson to ramp up. How does that look internationally? Is that breakdown as high and also is it still the same 6 to 12 month time line?

Yes, I spend a lot of time overseas and I don't see a significant difference between domestic and international in terms of ramping. If anything, the domestic guys have a little bit of advantage because they have more help nearby, where the international guys are oftentimes lonely and far from somewhere. I would say that the domestic guys have a little bit of advantage on them.

All right. Thank you.

Kirk Materne, Evercore Partners.

As you guys get into more complex discussions with partners looking to build new and different apps on top of your platform, how do you think about building up a professional services organization or partnering with more smaller SIs or bigger SIs, make sure that there's the technology capabilities in the market to allow them to really experiment with your platform that's so open ended in so many ways. what's your thought process on that? I'm particularly interested in your thoughts about bringing on more small system integrators into the ecosystem. Thanks.

Okay, so I forget what we have right now. I think worldwide we might have 15 people in professional services, it's a small team. Mostly formed up to help our partners ramp as well as take care of core customers that just want professional services from us. And they want our skin in the game. I really look at our partners today and it's kind of a tiering model. It was very difficult for us to build an integrator ecosystem in the early days. Because Splunk is so easy to deploy and the time to deploy is so short, that there hasn't been much of an economic model for partners. Most of our customers that are in the 1 to 20, even up to 50 gigs a day size, they deploy in 24 to 48 hours. So there's no business proposition for a partner to go in there and sell services. It's only when you get to a larger installation with a customer where Splunk has become the data platform and now we're talking about data architecture and efficiency and servers and storage and fail over and all that stuff, all of a sudden the business is complex enough that the integrators start to get interested.

Now we have multiple integrators who have approached us, we've approached them, and we're working on accounts together and I think it's looking pretty good. As Dave said, we had something like 35% of our business go through partners in Q1, so it was a healthy piece of business for them and for us. I think as we expand from really easy to use, quick to deploy departmental tool to large scale enterprise vendor, that really offers them a consultation opportunity that they didn't have a few years ago. So I would just say stay tuned on that. I'll try to give you a little bit more, maybe next call we'll give a little more color around some of our partner activities. Making really good progress there. It's the big standardization actions in customers that really drive that opportunity for them.

Thanks.

James Gilman, Drexel Hamilton.

Good afternoon, gentlemen, and nice top line growth. Godfrey, I wanted to -- you mentioned earlier in the call your discussions with your customers are going to -- how we use much larger scale. And I was wondering has the discussion around maybe pricing changed a little bit how you might price the solution? Then I have a follow-up question.

We've -- when we have those ELA type discussions, it's often about what -- for us still it's about data volumes. Because you can roughly approximate a 50 gig Splunk license in a large installation to a quad core server and say okay, that's the level of performance you'll get in order to do X, Y and Z and when you put 10 of them together, you get up to enough terabytes and you're talking about a significant amount of hardware for indexing, search heads, distributed, storage, all that sort of thing. So it's a deployment. So the customers who want to have that conversation actually don't mind still using our data volume, our indexing volume as a proxy for how big big is. So no, it hasn't really been -- as long as the price per gig is reasonable and the way they can pay for it is reasonable and they way our deployment model is done is reasonable, they're pretty happy. So no, I haven't -- it's quite possible we could look at other models but for right now, the conversation still reverts back to indexing capacity.

Got it. That's great. And the last one here is I don't know if I missed this when we were talking about metrics, last quarter I think you had if I heard -- if I had my data correctly, 11 figure -- 11 deals that were above $1 million. Did you give out the number? I know you mentioned several, could you quantify that?

Yes. We did give out 11 in terms of seven-figure transactions in the fourth quarter, 25 for the full fiscal year last year. But that's a metric we'll likely just give on an annual basis.

Okay, great. And again, nice growth there. Thank you.

Thanks, James.

Derrick Wood, Susquehanna.

This is Rakesh Kumar for Derrick. My question is for Godfrey. I wanted to follow up on the BNY Mellon example with Microsoft exchange app. Do you see that as a trend where apps lead the conversation for new business?

You broke up there, can you say the -- I heard Bank of New York Mellon and Microsoft exchange app and then you blanked out. Can you say the last part again?

Yes, do you see that as a trend where apps lead the conversation for new business?

Thank you. Yes, absolutely. You have to have an entry point to go into a customer. You're always looking for a way to identify the technology that you have with a pain that your customer has because that pain is likely to be where they've allocated budget or where they've allocated organizational attention. So to just go in and say hi, I have a logging engine is not sufficient to generate the kind of attention you want. So a big part of the attraction of these apps is we're able to go right into -- they're like a sharpen entry point, you can go right into the department where they're managing the F5 load balancers or the Palo Alto Networks or the Microsoft exchange environment or the guy who's running active directory. These guys have specific pain and the fact that you can show them almost immediately how Splunk can solve the problems they have becomes a real accelerator. It's also a real accelerator on deployment because Splunk deploys rapidly now but with an app on top of it, you further accelerate the time to live deployment. So yes, it's -- the apps are a significant advantage.

Great. Thank you.

Thank you and that does conclude our time for questions. I'd like to turn the program back over to Ken Tinsley for any additional or closing remarks.

Thanks great. Thanks, Huey, for all your help today, we appreciate it. And thanks everybody for your participation, have a good evening.

Thank you, sir. Again ladies and gentlemen, this does conclude today's conference. Thank you for your participation and have a wonderful day. Attendees, you may now disconnect.