Splunk Inc (SPLK) 2014 Q2 法說會逐字稿

Good day, ladies and gentlemen, and thank you for standing by. And welcome to the Splunk Incorporated second-quarter 2014 financial results conference call. At this time, all participants are in a listen-only mode. Later, we'll conduct a question-and-answer session, and instructions will follow at that time.

(Operator Instructions)

As a reminder, today's conference may be recorded.

It's now my pleasure to turn the floor over to Corporate Treasurer and Director of Investor Relations Ken Tinsley. Sir, the floor is yours.

Great. Thank you, Hughie, and good afternoon, everyone. With me on the call today are Splunk's CEO, Godfrey Sullivan, and CFO Dave Conte. As a reminder, today's conference call is being broadcast live via webcast; and shortly following the call, an audio replay will be available on our website. By now, you should've received a copy of our press release, which was distributed this afternoon. If you have not, it is available on the Investor Relations section of our website.

Before we begin, I'd like to remind you that during today's call, we will be making forward-looking statements, including our guidance for future periods; uses of our software; the size of license purchases; the estimated timing, features and pricing of new product releases; and expected announcements that we will be making at our users conference next month. Such statements reflect our best judgment based on factors currently known to us, and actual events or results may differ materially.

Please refer to the documents we file from time to time with the SEC, including the Form 8-K filed today with our press release. Those documents contain important risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. Forward-looking statements made during this call are being made as of today, and Splunk disclaims any obligation to update or revise these statements. If this call is replayed or reviewed after today, the information presented during this call may not contain current or accurate information.

During this call, we will also discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of the GAAP and non-GAAP results is provided in today's press release and on the Investor Relations section of our website.

With that, let me turn it over to Godfrey.

Thanks, Ken. Hello, everyone, and welcome to the call. Q2 was another strong quarter. Revenue for our fiscal second quarter was $66.9 million, up 50% compared to Q2 last year. License revenue was $43.2 million, up 43% versus last year.

We are delighted to welcome more than 400 new customers to Splunk, and now have more than 6,000 total customers around the world. New customers include SunTrust Bank, the Commercial Bank of Dubai, Panasonic in Japan, and Shaw Communications in Canada. Nearly two-thirds of the Fortune 100, and over 200 of the Fortune 500, are now Splunk customers.

All of our core segments posted good results. As always, I run across some creative customers during my travels that are doing compelling work. One of the world's largest athletic apparel companies conducts a Saturday auction for limited-edition running shoes. Their digital markets organization monitors their online sales and merchandising process from start to finish with Splunk. They want to see who's buying, what's selling faster, how quickly orders are fulfilled, and overall systems performance. This is a good example of a company that didn't start with a traditional entry use case like troubleshooting. Instead, they jumped directly to business analytics and customer experience.

In past calls, I had fun covering customers who indexed their elevators, their buildings and their electric cars. Now Splunk is monitoring data from sensors on trains. One of the largest North American rail carriers is using Splunk to improve rail safety by capturing and analyzing log output from the train sensors. Their ultimate goal is to prevent accidents, help enforce speed limits, and, of course, comply with federal safety mandates. The breadth of use cases that we see in our market opportunity also requires that we expand and diversify our products to better serve our customers. I believe our next phase of growth will be driven by moving from a single-product to a multi-product company.

Up first, our next major release of Splunk Enterprise is in late beta testing; customers are quite happy. We expect to ship concurrent with our annual users conference next month. At conf, we'll demonstrate new capabilities designed specifically for non-technical users to do fast exploration and analytics on their machine data.

In June, we announced the beta program for a new product, Hunk, which is Splunk analytics for Hadoop. Hunk brings our ad hoc exploration and analytics capabilities to the historical data that is already at rest in Hadoop, and is simply too big to move. Hunk uses a patent-pending virtual index technology that enables Hunk to work directly on top of the Hadoop cluster. Our beta customers are telling us that they went from installation to analytics in an hour or less, a much better experience than hiring programmers to write map-reduced jobs and wait for the results. While we haven't released pricing for Hunk, we expect it to be consistent with established pricing models for the Hadoop ecosystem, which is typically subscription based on the number of nodes in the cluster.

Moving on to content, a week ago we announced the latest version of the Splunk app for VMware. This app provides visibility across virtualized environments, and is now our third premium app, which means it has a modest price and has full product life cycle management. The VMware app gives customers the ability to correlate VMware data with logs, events, performance data, availability metrics and alerts and the like, from the rest of their IT stack. This app showcases our ability to provide deep levels of analytics across the entire stack, including the virtualization layer, and has about 25 out-of-the-box reports.

One CIO recently told me that Splunk's VMware app helped them identify 17% idle capacity, and saved them an entire year's worth of CapEx on their IT stack. This represents millions of dollars worth of hardware that they don't have to buy next year.

More than 400 apps are now available on Splunkbase, with 23 new partner and community apps added during Q2. Some of our partners are monetizing the apps they build on Splunk. For example, Prelert's Anomaly Detective offers an app that performs machine-learning predictive analytics. And Cloudmeter released their Stream app, which enables Splunk customers to analyze raw packet data from networks to gain visibility into online applications, user experience and business outcomes.

Now on to the cloud. We are planning to extend our offerings in the cloud, as a result of what we've learned from our Storm deployments. We'll have more to say at our users conference, but a few highlights today. We have about 300 customers now on Storm, and several thousand projects, mostly developers, but we're also seeing some operational use cases. Our developer customers have a strong and consistent pattern of usage. They start projects, run test dev logging, and either move the system to a production environment or turn it off. Developers were our first target market, and it's what we designed Storm to do.

On the other hand, our operational customers look a lot like our Splunk Enterprise customers, and they have a wide variety of data sources and use cases, and unique requirements. These use cases look a lot more like hosting than SaaS. At the summary level, we see the cloud business bifurcating into developers and operational use cases, and we will ultimately use different models for these two markets, which I will explain further at conf.

A few comments about our core markets. We continue to see customers expanding over time from one initial use case around apps, monitoring, IT ops or security, to other core use cases. We're also seeing new customers making initial purchases for multiple use cases. An example of this is GitHub. They're the world's largest open source community, and most popular code host, with more than 4 million customers. They generate massive amounts of log files, and will use Splunk for both IT ops and security. They'll also want Splunk to ensure that their customers are having a good experience on the site.

Bloomberg, a longtime Splunk customer, has now standardized on Splunk as a platform, and have established a center of excellence to support their global rollout. Moody's expanded their Splunk deployment from website monitoring to the security team. Their initial success with Splunk drove a sizable upgrade last year; and this quarter, they expanded their use of our platform into the security department, including the purchase of our app for enterprise security. B&S Card Services, the largest credit card payment service in Germany -- they selected Splunk Enterprise in Q2 to replace their existing [SIEM] vendor.

We now have more than 2,500 security customers, and our Enterprise security app had its best quarter ever. Business analytics and digital intelligence are expanding markets for us. Recently, we announced a partnership with [Telium], which enables customers to bring client-side data from user interactions on the website into Splunk Enterprise, and then correlate that with server-side data and other data sources. Through this integration, [these] customers now have a deeper understanding of how they are interacting with their users across digital channels.

We also announced a partnership with Pentaho, which released a new app called Pentaho Business Analytics for Splunk. This integration further extends the reach of machine data insights for business users.

Now to developers. Many of our corporate customers are using our dev tools to build Splunk apps. It's this combination of the Splunk platform and in-house custom apps that broadens the use of Splunk across the enterprise. An example of this is an automotive dealer services company who have built a customer analytics app using our Java SDK. This app shows their auto dealerships a real-time stream of search terms made by their prospective customers. Their dealers are reporting that this real-time information on customer preferences is as valuable as someone walking onto the lot.

In Q2, we also announced the availability of SDKs for C-Sharp, PHP and Ruby. These SDKs, along with the SDKs for Java, JavaScript and Python that we shipped last year, provide complete coverage for developers across the most popular dev environments, and extend the power of Splunk as the enterprise platform for machine data.

In closing, we are excited about our momentum. New products are on the way -- a new version of Splunk Enterprise, Hunk, and our expanded cloud offerings. I'm also pleased that we've shipped now our third premium app for VMware, driving immediate and meaningful ROI. Customer feedback on the beta release of Hunk is positive, and we expect to ship that product before year end.

We're breaking attendance records at Splunk live events all over the world. Many thanks to our customers for your outstanding presentations, and to those of you on the call who have invested your time to attend and learn more about our Business. I look forward to seeing you at our worldwide users conference in Vegas next month.

And now, over to Dave.

Thanks, Godfrey, and good afternoon, everyone. Thanks for joining us. Q2 was another solid quarter for Splunk, and I am pleased with our results. Second-quarter revenue was $66.9 million, a 50% increase over Q2 of last year. And license revenue grew 43%, totaling $43.2 million for the quarter. Our results were driven by continued adoption and expansion of Splunk within the enterprise, and are reflective of the continued value we're providing our customers. In Q2, we added more than 400 new customers, and recorded 163 orders greater than $100,000.

Last quarter, I detailed how our customers consume Splunk software across a broad set of use cases. Our core markets of IT operations, applications management, and security continue to represent about 90% of our quarterly business, with each trending at about 30% over time. We're seeing this type of use-case breadth not just in the US markets, but internationally as well. In Q2, international operations represented 21% of total revenue, up from 20% last Q2, and consistent with Q1. With respect to our channel strategy, almost 45% of total Q2 bookings worldwide involved our partners, which helped drive strong results regionally, where international operations grew more than 50% year over year.

On the field side, we continue to expand our reach. We ended the quarter with 189 quota carriers, up 15 from Q1, and we're tracking to end this year with between 210 and 220 field reps. Outside quota carriers continue to represent about two-thirds of our direct team, and inside, one third.

Now, for your models, average quota for a tenured outside sales rep is about $2 million, and an inside rep is about $1 million. I said that it generally takes a new sales rep 9 to 12 months to be fully tenured and fully productive. Given our growth in reps, about 50% were tenured as of the end of Q2

Now, with respect to term versus perpetual bookings composition in the quarter, 18% of license bookings were from term licenses. As I've described, we do not differentiate by license type when compensating the field teams; rather, we enable customers to buy and use our software based on their needs.

On the last few calls, I've described enterprise adoption arrangements, or EAAs. These types of transactions are typically large orders, usually in the seven-figure range, and are designed to enable broad adoption of Splunk within an enterprise. These transactions usually contain provisions which require them to be deferred, and treated ratably in terms of revenue recognition.

Since we expect to do more enterprise adoption arrangements going forward, I want to give you a little bit more detail in terms of how these look. Specifically, an EAA is typically a perpetual license with a prescribed maximum daily indexing volume, and allows the customer the ability to spike above the limit without penalty. The agreement requires that at some point in the future, which is typically three years, we'll measure the amount of usage over the limit, and upgrade the license at a rate specified in the contract.

This accomplishes two important adoption objectives. First, it allows the customer to better match their license size and cost with their expanded use cases and multi-department deployments without concern of capacity constraints. Second, it provides the visibility required for cost and budgeting purposes related to their future utilization plans for Splunk. We expect to complete more of these types of transactions, particularly in the back half of any fiscal year.

Just to reemphasize, we expect to see continued variability not only in the mix of term and perpetual licenses, but also the number, size and timing of enterprise adoption arrangements going forward. Over time, the combination of term and EAAs could represent anywhere between 20% and 30% of license bookings in any quarter.

Now, another consideration for your models is Hunk. We expect to sell Hunk as a term license subscription when it's released, so bookings will be deferred and revenue recognized ratably, which is consistent with the typical subscription model.

Okay, turning back to the quarter, our maintenance renewal rate increased to 94% in Q2. The investment we made in dedicated renewals team has driven an increase in renewal rates from the mid-80%s 1.5 years ago to the mid-90%s now. Customers also continue to leverage our professional services and educational offerings, which together represented 6% of revenue in Q2, in line with past levels of 5% to 10%.

Recall, the following non-GAAP operating metrics exclude non-cash stock-based compensation, as well as employer payroll taxes related to employee stock plans. Q2 overall non-GAAP gross margin was 90%, in line with prior quarters, and gross margin on services, which includes support, maintenance, professional services and education, was about 73%, also consistent with prior periods. Non-GAAP operating loss was approximately $800,000, representing a negative margin of about 1%, better than our expectations, and reflective of our higher revenues. Non-GAAP net loss for the quarter was $1.2 million, or $0.01 per share, using a weighted average share count of approximately 104 million shares.

DSOs were on the low end of our expectations at 56 days, while cash flow from operations was $6.3 million. Free cash flow was $4.3 million, and we ended the quarter with about $350 million in total cash.

We will continue to run the Business on a positive-operating-cash-flow basis going forward. We do expect to increase our capital expenditures over the next 12 months, as we expand our facilities footprint to support our field operations and customer growth, specifically with expansions of our San Francisco and Bay Area offices.

Looking forward, we expect Q3 total revenue to be between $69 million and $71 million, with license revenue contributing about two-thirds of the total. Going into this year, we expected fiscal-2014 full-year revenue to range between $260 million and $270 million. With our first-half performance and Q3 outlook, we now expect full-year revenue will be between $275 million and $281 million. Consistent with our prior guidance and investment strategy, we will continue to invest significantly in product development and field operations.

We expect Q3 non-GAAP operating margin to range between 0% and a negative 2%. We still expect full-year non-GAAP operating margin to be roughly breakeven, meaning Q4 non-GAAP op margin will be positive. Importantly, for your model, and as a reminder, because we expect non-GAAP profit to be profitable in Q4, you should use a fully diluted share count of about 120 million shares when calculating EPS.

Our customer success has been the result of Splunk delivering high-value products, and we're committed to extending and expanding functionality and ease of adoption of Splunk to new and existing customers. We've complemented the capabilities of core Splunk with recent innovations in Hunk, cloud, our apps and our platform development, and we're broadening our overall product set to make Splunk the most relevant, easiest to use, and highest ROI solution in the market.

Overall, I am pleased with our first-half results. We appreciate all your time, and we now welcome your questions.

Thank you, gentlemen.

(Operator Instructions)

John DiFucci, JPMorgan.

Thank you. I have a question for Godfrey and then a follow-up for Dave. Godfrey, Dave talked about the EAAs here. And a couple of quarters ago, in the January quarter, you had that big $20 million deal. So large deals seem to be making more sense for you, at least for your customers. And they seem to be having a bigger impact. What's driving that? Was it that $20 million deal? If someone else is willing to make that level of commitment to Splunk, has that encouraged others? It sounds like Dave said you would see more of those EAAs in the second half of any given year. I assume that means this year, too.

Hello, John. I don't think that the $20 million transaction had any particular effect on the business. Every customer makes their decisions based on their own requirements. But I would say that the thing that's driving continued enterprise adoption is just that move of customers from departmental to multi-departmental and then reaching enterprise. And when they get to that point, they typically want to move their relationship with us from transactional to strategic, and it's more about an overall account plan and all that. So it's just a healthy evolution in the relationship.

Okay. Great. And Dave, on those EAAs, you said they were perpetual license, so they are not term license. But you could have perpetual license where the licensed portion is recognized either at milestones or over time. Is that what these typically are, or typically these license revenue, is it recognized all up front?

Hello, John. Well first, an enterprise adoption arrangement can be term. We would include that in our -- previously, we'd expect anywhere from 10% to 20% of the business to be term. Now as we're getting into these adoption arrangements, we're seeing an uptick in effectively what becomes ratable revenue. So even under an enterprise adoption arrangement as I've described it, even the license component would be deferred and recognized over the term.

Just so I understand, it is term and ratable, but can it also be just recognized at certain milestones, like once a year or something like that, or typically it would be just recognized at term ratably over the life -- equally over the life of the contract?

Our experience is that the revenue from an adoption arrangement will be recognized over some period of time on a ratable basis, evenly. So it won't have milestone recognition, or the license component won't be up front. Again, in the prepared remarks, I mentioned most of these periods are three years, in terms of the duration. And that's driven by the specifics of any particular contract. Our overall average term life still is about a year. So of the Q2 results, 18% of license bookings were term. Those are, again, on average, a year long. But when we get into the adoption arrangements, we're trying to structure them so that the customer has enough time to go through a broad deployment across the enterprise. And that's typically three years. What you'll see flow through the financial statements will be ratable revenue. And of course, it gets apportionately allocated between the license and the services component.

Okay. Great. And it was really nice to see that maintenance renewal pop up again. Very nice job, guys. Thank you.

Well, that was our John DiFucci initiative is what we call it here.

Thanks, John.

Keith Weiss, Morgan Stanley.

Thank you guys for taking the question. Very nice quarter. I was wondering if you could talk about the sales structure. As you guys add on new these products, like Hunk, and the portfolio applications expand, and you have Splunk Storm now, is there going to be any need to further specialize the sales force around some of these products? Or is it still narrow enough product portfolio that a sales guy could handle the whole spectrum?

Keith, it's Godfrey. The answer is yes and yes. One of the challenges of Splunk, and why it takes our new account execs a while to mature and reach some sort of tenure is because there's so much to learn. And we've talked in prior calls about how we are starting to specialize our segments. So we have identified the security experts around the world, and we are starting to map and deploy security experts all over through our field organization, because those POCs, those customer requirements, tend to be a little bit more specific and you need a security background in order to be able for us to put our best foot forward. I don't know exactly how, for example, Hunk will affect that, but my guess is we'll learn as we go. But my guess is we'll have to do the same thing in terms of hiring people who have business analytics backgrounds, because the data that's often coming out of a Hadoop cluster is structured, unstructured, you name it. And we're combining all that inside of a virtual index. And the questions customers are typically asking, after the fact, out of a batch system, tends to have to do more with customer analytics than it does in a Splunk index, where you're looking at real-time information about servers falling over or transactions failing. So the answer is yes and yes, and we're doing that already for the security market, and I wouldn't be the least bit surprised to see the business analytics segment be the next one where we have to invest in some overlay resources.

Got it. That makes sense. And then one last one from me, on overall ASPs. We've talked a little bit about the enterprise agreements and doing these very large deals. But your overall average production size, how has that been trending over the past year? And how do you see it trending on a go forward basis?

The transaction sizes are still in the mid-$30,000 range, something like that. Our ASPs, if you will, haven't really changed too much over the last year, because we continue to bring on lots of new customers at lower ASPs. Dave, the mix of existing customer expansions was still what, 70% of license revenues?

Yes. 70% of the quarter's license bookings were upsells to existing customers. Probably two-thirds of those were expansions; a third, upgrades to more capacity. In terms of ASPs, you are spot on. They're right at $35,000, which has been consistent over a number of quarters. That despite the fact that we did our second-highest number ever of greater than $100,000 transactions, 163 for the quarter. And of course, that means it's just proportionate to overall transaction volume growing. In terms of the sheer number of transactions that we've done, that's pretty simple math. That's how the ASPs stay where they are.

Thanks.

Thank you.

Brendan Barnicle, Pacific Crest Securities

Thanks so much. Godfrey, in one of your examples, you talked about sensor data. I think it was a railroad. But as we think about the increasing use of sensors more broadly, how do you think about that TAM and opportunity, and how do you best capitalize beyond railroads, into the internet of things?

Well, that's a good question. If all you are doing is analyzing one type of sensor, think of it as one log. There are plenty of ways to do that. And Splunk might or might not be the best way to do that, kind of depends on the circumstance. Where we really shine is when you're combining multiple data sources and then trying to do correlations across that and get analytics or insight, both in time and over time, that's where Splunk really has its unique differentiation. So as we look at internet of things markets, we typically don't just try to go out and say, well, gee, you've got this one thing, like a thermostat, use Splunk for that. Because there's plenty of ways to solve that really simple problem. It's where we see customers who are actually trying to combine a new type of sensor data. A device got smart. All of a sudden, a train got smart, it has a sensor on it, it's able to wirelessly transmit that information. And then you're able to correlate that with other things, other machine information, relational database information, you name it. It's when we're combining all those data sources is where Splunk really shines. In a nutshell, we look at the internet of things and look for use cases where the data is complex.

Great. And then Dave, just two quick follow-ups for you. As we start thinking about more of this ratable revenue, one, will everything show up on the balance sheet or are we going to have some off-balance-sheet activity that's going on? And what do are you thinking of sharing in terms of billings or bookings?

So in terms of these arrangements, even outside of -- in terms of what shows up on the balance sheet and what doesn't, you guys should recall that our services business, professional services business, rarely flows through the balance sheet. And combined with education, that was 6% of revenue this quarter. So there's a number that's out there that doesn't ever reside on the balance sheet. As it relates to the adoption arrangements or some of the term transactions, a majority of those are billed when we deliver the keys. There are some transactions that have extended billing terms that don't show up on the balance sheet. So I think that answers your question, Brendan.

Great. And then just last quarter, just following up, you had said the breakdown between existing customers and upgrades, I think it's still been the same, two-third/one-third. Wondering if any change there? And then you'd also shared some data about original purchases, I think, being 4.5 to 5 times during the three years following the initial purchase. Any change in any of those metrics?

So for the latter, we haven't updated the cohort, that sample size. We used the same customers -- we did a two-year cohort a year and a half ago. We updated that for a three-year cohort, same sample size of customer. So it will be spring of next year when we will look at that and say, okay, now over another year of life as a Splunk customer, what's their buying patterns? In terms of upsells to existing customers versus new and the bookings contribution, Q1 actually was a bit anomalous, in that new customers represented a higher percentage of the dollars in Q1, which was really the result of having a large new customer, a seven figure customer, their first purchase be a large dollar amount. And being Q1, it skewed that metric a bit. So this quarter is more consistent with what we've experienced over the last several, which is 70%, roughly, of the quarter's license bookings coming from the install base.

Great. Thanks, guys.

Thanks a lot.

Phil Winslow, Credit Suisse.

Hello. Thanks, guys. I just was hoping for an update on the application developer platform initiatives there. They started a couple years back. Godfrey, where do we stand right now, and then what are your expectations for that going forward?

How you doing? We're in pretty good shape. We had started a couple of years ago and had in mind these six platforms that I rolled off on the call. And we now have those shipping. So the big bulk of work around the SDKs is behind us. And we, of course, maintain them and improve them and all that. But the big bulk of it is now done. Now we believe that we can map to and satisfy most of our corporate customers who are doing in-house development in their favorite language, whether it's Ruby or Python or what have you, and they have the SDKs to support that work.

The bigger opportunity now is for us to go to those corporate customers and say, you can now build an in-house custom app, maybe it's a customer support app with a forms views. And the customer -- the users, their employees now, get the benefit of using Splunk without ever having to learn the search language or know anything about logs. They just put the customer's name, their phone number, their key phone ID in, and hit Go. And Splunk can go down behind the scenes and show them why the authentication didn't work, or whatever. Now you're starting to see our enterprise -- our corporate customers build custom-based apps on top of Splunk that enable widespread use across their company. But what the employee is using doesn't look anything like Splunk. So it's just a great way to propagate the platform into more use cases across the enterprise. And that, to me, is the next phase of work.

Got it. And then just one more question, too. Obviously, your international business has been growing strong and still relatively small percentage of revenue. Just give us an update on your strategy there and where you are in terms of executing on that plan.

We continue to have ambitious growth plans for our international markets. We continue to invest heavily in resources there. Sometimes it's a new country. Of late, it's been more about putting additional resources inside of countries where we now have a presence. And so we continue to push those guys to invest as heavily as they can and grow as fast as they can. The biggest challenge in the international markets is getting critical mass in any given country. We put your first two people in Japan, they're not very effective, because there's just too much market for them to cover. So the biggest challenge for us now is just sort of investing a little less in new country development and a lot more in terms of getting critical mass into each geography.

Great. Thanks, guys, and congrats on another killer quarter.

Thanks very much, Phil.

Thanks, Phil.

Daniel Ives, FBR Capital Markets.

It's actually Jim Moore in for Dan Ives. Great quarter. Just a quick question on a follow-up to the international business. Can you guys talk a little bit about what you're seeing in the different regions? I know you don't generally break it out.

Gosh, we had a strong quarter in both Asia and Europe. Some quarters, I'll moan and complain because southern Europe was soft, or southern Asia was soft, or some other thing like that. I really don't have much to moan about today. Those guys did a terrific job. I'd say our business in northern Asia and Australia was a little stronger than the South Asia, ASEAN area, but now we're splitting hairs. The UK was particularly strong for us in Q2, but Italy did well. Sorry, I don't have any stones to throw. I usually have something to complain about, but I think the field teams just did an exceptional job in Q2.

Great. That's a high-class problem to have then. And then on the competitive landscape, is there anything you could talk about there?

Nothing new. We still have lots of competition. It tends to be in the specific segments themselves, like security or app monitoring, or something like that, biz analytics. Tends to be different people who we see in each of those segments. And they're always trying to position us as not having as much functionality as they have, and we're always trying to position them as being a point solution, and we have the broad platform that can ingest large data from multiple use cases. That is always the nature of the competitive element. It just doesn't seem to change very much. So we try to de-position them and they try to de-position us. But I like our story better than theirs.

Great. Thanks very much.

Thanks, Jim.

Raimo Lenschow, Barclays.

Thanks for taking my question and congrats on a good quarter from me, as well. Couple of ones. First on Hunk, talk a little bit about the opportunity here, more from an analyst, we always think about much money you can make there. How do we have to think about that in terms of how you -- what you can monetize there as an opportunity, and then how big that could get. And then I was asking on the -- the second point was more on the pricing for the apps that you have there. How do have to think about that, as well? So how do you price that, and how much of an opportunity is that? I know you're making the money more on the platform side, but is that something we should pay more attention to, or is that going to be -- continue to be more something on the side? Thank you.

Thanks, Raimo. I'll take Hunk first. Customer receptivity to Hunk is quite positive. Because once they've taken all this data and put it into HDFS, it's at rest. And they call it different things, like data pools and data lakes and data forests. And you hear all these funny descriptions from the customer base about what do you do with all this data once it's there. The one characteristic they all agree on is it's too big to move now. And so all the solutions that require you to move massive amounts of data out of HDFS somewhere else to analyze it is almost a non-starter. So now that's why you see everybody hiring technicians and developers who can write map reduced jobs to try to go get some data out of it.

Enter Splunk. You just drop Hunk on top of the HDFS cluster and you start searching it. You say, okay, over this time dimension, give me all the places where this plus that, not that, happened. And back comes the answer. So what's happening is that Splunk is the -- sorry, Hunk, is, as you type in the search, it's actually writing the map reduced job for you, and then going out and getting the answer out of a Hadoop cluster. It's pretty amazing. Anyway, you get the answer back now, or pretty soon. Not a deep batch job. So customers love this stuff.

So am I bullish about the opportunity? Absolutely. What's holding it back in terms of being able to put a forecast together or talk about how big big could be, and that is, there's still not very many customers who are live in production and successful with a large cluster. There are a lot of folks who have put data in there and haven't been successful getting it back out. And Gartner wrote a piece on this whole trough of disillusionment thing three to six months back. And that's an issue. So I don't know how big it is until we get the product shipped and get some live references and ROI stories. All that stuff has to come before customers will start spending money. But we will ship Hunk before year-end, and I think it's a really great product for us next year and the year after.

On your question about apps. Apps don't create a large enough revenue for us today to make it worth breaking out and talking about as an individual line item. But as we continue to put more and more premium apps in the market, there will come a time when we make enough money off of those to make it a meaningful number and talk about that more specifically. Right now, those apps are like templates that are quick start packs that drive a specific use case of Splunk, and usually they have a specific ROI or benefit or outcome. And that helps the customer get it faster. And that's really what the app does. It helps the customer see the value proposition right now and understand what they get back from this data platform. So very bullish on what we can do with apps, and look forward to the day when we're breaking out revenue.

Perfect. Thank you.

Thanks, Raimo.

Brent Thill, UBS.

Good afternoon. Godfrey, just a couple questions around customer adoption. The first one is just around the move from the specialists that you've seen early on to the mass-market users. And I think you refer to that more of the non-technical users. Maybe give us a sense of where we are at on that adoption pas of going to those non-technical users, which seems like it opens up your TAM materially getting into the hands of those users. And I had a quick follow-up.

Hello, Brent. Yes, we are at the very early stages of that adoption life cycle for business analytics. We often think internally about three phases of operational intelligence moving from troubleshooting to real-time monitoring and alerting and all that, and them ultimately to real-time analytics. Usually that's a phase that our customers evolve to, but it's not the phase where they start. What was interesting in my travels last quarter was to see this apparel company that actually started with it saying, that's exactly what we need Splunk to do is provide business analytics for us in real-time, customer experience in real-time. They could care less about whether the servers were falling over. They wanted to see how it impacted the revenue. And this is a great place for us to evolve. But as I have said often, I tell our guys, don't use the words BI around here. Splunk is not a BI company, per se. What we can do is create financial analytics or customer analytics out of machine-generated data, which the BI guys simply can't do. So I think this is a new chapter in the world of customer intelligence, and we will -- I think Splunk will be responsible for inventing how that plays out. But it's early in this particular segment.

Okay. And just real quick, any particular verticals or geographies where you maybe thought that weren't going to light up, are lighting up faster than you thought or you're seeing increased traction from what you saw maybe a year ago? Or is it pretty much across the board, from your perspective?

It's across the board. But the industry segments that shows the greatest strength are the ones that have high transaction volume. The mining companies haven't been a big vertical for us, because they dig dirt and they just have the simplest of IT systems, and that's not their business. Banks, websites, online travel, telecom, so forth, are really strong verticals, because they have a very high transaction volume and the data that's machine-generated is very valuable to them. I think the next segment where that will be the case is healthcare.

Thank you, Godfrey.

Thanks, Brent.

Ed Maguire, CLSA.

Good afternoon. Last quarter, Godfrey, you had discussed this inflection that you'd seen in the security market. And I was curious if that's continued and whether there were any other segments in the business where you're starting to see similar dynamics?

Yes, security was strong again for us in Q2. I think when we went out on the road, we talked about apps at 30%, infrastructure at 30%, and security at 20% or something. I'd say security is now up to probably more like 30% of the business. It's an imprecise measurement, because we get that data based on what the account execs put into Sales Force. When they put an opportunity in, they may check one box or two boxes, but maybe they didn't check the right box, or maybe there were multiple boxes and they only checked one. That sort of thing. So when we report that data, we're a little cautious about in terms of trying to give you guys stuff to rely on. But I think you could rely on the fact that the security market is really strong for us, it has grown in terms of the percentage of our mix, and our product is very well received there.

Great. And just a follow-up on the EAAs, this idea that you're going to allow your customers to use the data as they need and, I guess, burst capacity if necessary. Just to clarify, you're going to have essentially true-ups of actual usage at -- per year, or at the end of the contract? I just wanted to clarify that.

It depends on the contract. The number one thing that customers don't want to do is have an unexpected budget surprise. So first of all, customers like our pricing model, because they don't have to count servers and they don't have to count users and they don't have to count connectors. There's a lot of stuff they don't have to count. The machine just sits there and reports to them how much data they're actually using, and we don't charge them for how much they store, we just charge them for how much they index every day. In many ways, it's an easy model.

The one thing they don't like about it and want us to solve is if we start -- if Splunk proves to be very popular and our indexing grows, or if we have spike periods during the periods where we have to do a security investigation or something falls over, we don't want to be penalized because we had a spike of activity. So it's quite normal in our agreements these days, especially the large ones, is that we give the customers the ability to burst mode over without penalty, or even run at an average above what they've contracted for without penalty. We're trying to take the unexpected budget surprise away. And they are very happy about that. And so the contracts can be term, they can be perpetual, they can be ratable. They can be a lot of things. But what we're really trying to do is just make sure that Splunk is easy to deploy and easy to expand and no budget surprise.

Thanks, very helpful.

Thanks, Ed.

Steve Koenig, Wedbush Securities.

Great. Thank you. I'm wondering, Godfrey, you talked a little bit about Hunk being used for, it was either business or customer analytics. Could you give us a little bit more color on the initial Hunk use cases? And do you have -- are customers at all looking at Hunk as potentially -- are they interested in using it instead of the Splunk enterprise back end, in any use cases? And then I have one quick accounting-type follow-up.

Okay. So we'll learn more about this as we get further into it. I think we have too small of a sample set right now to give anything that's mathematical or logarithmic or any of that. So here's the way I look at it. If you have a big Hadoop data set, too big to move, that's a market that's a new market for us. They're either using a set of open-source tools or they're using some other basket of stuff and they're trying to get data out. So for us to be able to put data -- to put Hunk on top of that and enable them to use effectively the Splunk search language right on top of a Hadoop cluster, to me, that's plus business. Either we will get that business or we won't, but it's not data that we would have lost to Splunk enterprise, because they already made the decision that it was too big to move. So that part of it feels more incremental than substitutional.

As customers then ask, what should I put into the Splunk index? Remember that the Splunk index is temporal. It's a time-based system with a very fast read/write, real-time capability. So the data that you would typically choose to put into Splunk enterprise first, or bring it out of Hadoop and have it reside there, is because you want real-time, you want high-speed read/write operations, you want to be able to look at anomalies and threats and detections as they're occurring. There's a lot of use cases where needle-in-the-haystack search, all those types of things Splunk enterprise does a lot better than HDFS. The thing that HDFS does really, really well is taking a big, dense set of data and saying, okay, over the last year, tell me how many customers behaved this way and correlate that with some other information. And you're looking for long-range patterns over time, and Hadoop is really good at that. Where most customers don't want to bog the Splunk index down with that much information. They're using it for high-speed operations.

I think the difference in the use cases to us, and really to our customers that are beta testing Hunk, is actually pretty clear. But we'll have to let it hit the market and watch it over time.

Great. Thank you. That's helpful. And then if I may, can I ask specifically, were there any very large deals that contributed to bookings or licenses in the quarter? And also just I noticed that long-term deferred ticked down slightly sequentially. Any color on that would be helpful, too.

Yes, Steve. The change in long-term deferred was consistent with the first quarter, which reflects the $20 million transaction that we recorded in the fourth quarter amortizing between long-term and short-term. So the largest contributor to that shift is that single $20 million transaction.

Got it. And how about large deals in the quarter contributing to bookings or licenses?

There were no transactions that individually would require disclosure, whether in receivables or as a percentage of revenue, a significant customer. Last year at the end of the year, we provided a metric that we think is probably an annual metric around the number of seven-figure transactions we've done in the period. So we do a handful of those every quarter, some number of them, and we'll see how it shakes out by the end of the year.

Sounds good. Great. Thanks a lot, guys.

Thanks, Steve.

Karl Keirstead, BMO Capital Markets.

Thanks. I just wanted to ask you a question about Storm. You hinted at a new version of Storm, or at least an extension for more typical operational use cases. And I was wondering two things. When you would expect to have that product ready for prime time to go GA. And secondly, what portion of typical operational use cases can you now envision being hosted from the cloud, let's say in a couple years time? Thanks.

That's a great question. I don't know the answer to that question yet, as to how big it will get. I can tell you that the difference between developers as an audience, as a customer segment, and operational use cases are quite different, and just requires a different approach, different viewpoint to it. And we want to be responsive and be able to provide our customers Splunk, and however it is that they want to digest it and deploy it. So we're in the midst of developing that program as we speak, and we will have more to say about that at conf. So all you folks should come and enjoy a couple of days in Vegas with us.

Got it. Okay. Thank you so much.

Thanks, Karl.

Thanks, Karl.

Peter Goldmacher, Cowen.

At the beginning of the call, you said you're transitioning from a single to a multi-product company. And you also talked a little bit about how your customers are taking you to use cases you hadn't originally envisioned, even as recently as six months or a year ago. I think your apparel example and your rail example were examples of those. So how do we think about Splunk in three years or five years, when you are going to be -- you will have more products than the core product and Hunk, and you will probably be pulled into more different horizontal use cases and potentially vertical use cases. Do you think that it's appropriate to think about product development more along the horizontal use cases or the vertical use cases? I'm trying to correlate some of your data points here.

Hello, Peter. The number one thing to me that we have to correlate is our partner ecosystem. Because as we get all these different solutions in the market, it's not really possible for us to scale with just a direct sales force into all these different verticals. We will have to have a better and more robust partner ecosystem than the excellent one that we already have. One data point that is really encouraging to me is -- David, I think you said we had 45% of the business in the quarter through partners, which is an all-time high for us. And it shows that we're-- our field organization is getting better and better at finding, growing, developing and partnering with an ecosystem where we all have our shared objectives. But the types of people who will take Splunk to healthcare are not the same that take it to security departments, and not the same that will do Hunk analytics on big data sets. It's just -- the market opportunity is too diverse for us to think that we can do it all, but I'm really encouraged about the progress we're making on the partner side.

And on those partners, do they tend to be bigger systems integrators, or smaller vertically focused consulting groups, partners?

Mostly they tend to be country specific. So as I travel around, I see partners that are all the way from boutique, bar or SI shops all the way up to the large-scale integrators in Japan or Australia. It varies by geography. But we have relationships with partners large and small now, everywhere we go. I think we've made some pretty good progress there.

Okay. Great. Thank you.

Thanks, Peter.

Yes, thanks, Peter.

Greg McDowell, JMP Securities.

Great. Thank you very much. Just a quick question on sales rep productivity. And I appreciate the detail on the number of sales reps and quotas. It does look like license revenue per sales rep ticked up from Q1 to Q2. Is the ramp to full productivity for these sales reps, is that time frame staying the same, or are you starting to see that time frame shortened to full productivity? Thanks.

Well, I hope it shortens and we have a full team of people inside the field organization that spends all their days and nights trying to shorten field productivity. As the product line then grows more complex, that works in the other direction. So right now, there's been no real change. It's still in about the year period of time for new people to come into Splunk and learn what's becoming a very robust product line. So no change there. But we'll keep you posted. We work really hard to try to bring that in.

This is Dave. I've been poking at this for the last two years, since I joined. Because a year seems longer than what I would expect for an enterprise software salesperson. And I think it's really a testament to the breadth of the use cases across all the verticals that are the way our customers use the product. So instead of it being a repeatable sales motion into the same set of buyers in a same vertical for the same use case, our sales quota carriers and importantly, the technical guys, the SEs, it takes them more time to organize themselves around all the use cases that we find most prevalent in the verticals that we address. We don't today organize by vertical. Might we at some point? Sure. But that might have an impact on productivity ramp. But TBD on that.

Great. Thank you.

Thanks, Greg.

Derrick Wood, Susquehanna.

Thanks. This is Rakesh Kumar for Derek. I was just hoping you could talk about spending trends in some of the largest verticals and contribution levels.

Spending trends on the largest verticals, industry segments and the like?

Yes.

The ones that tend to be investing heavily right now in Splunk are in those high transaction environments. So again, telco, media, online, anything online. Banking is also online-- but you name it, any industry segment that has a high transaction volume is a pretty robust opportunity for us.

And if I could add a follow-up, just wanted to touch on your new app for VMware. WMware also announced a new log-in type product at their conference this week. I was hoping if you could talk about potential competition from VMware further down the line.

I don't really think about VMware as competition in the log area. They look to me like they're really trying to do a better job for their customers in terms of making V-Center a better management utility for that environment. And if we were running VMware, we would do the same thing. Our differentiation is always about being able to take a broad set of data sources, correlate those and provide value by that top to bottom look. And the VMware app actually just improves our ability to look at native data, like the ESX data, and then correlate it with all the other information we have. And that's a strength of ours and continues to be our competitive differentiation, pretty much the way we do it across other markets. I'm sure we'll run into that product from time to time, not yet. But I think our differentiation is the combination of VMware data sources with everything else. And we'll continue to try to do the very best job at that we can. So it's all right. Thanks for the question.

Thank you.

Thank you. That does conclude our time for questions. I'd like to turn the program back over to Mr. Tinsley for any additional or closing remarks.

Great. Hughie, thank you for all your help today and thanks, everybody, for joining. We look forward to seeing you at our conference next month and hope you have a good evening.

Thank you, presenters, and thank you, ladies and gentlemen. This does conclude today's call. Thank you for your participation and have a wonderful day. Attendees, you may now all disconnect.