Splunk Inc (SPLK) 2014 Q3 法說會逐字稿

Good day, ladies and gentlemen, and welcome to Splunk Incorporated third quarter financial results conference call. At this time, all participants will be in a listen-only mode, but later there will be a chance to ask questions and instructions will be given at that time.

(Operator Instructions)

And as a reminder, today's conference is being recorded.

And now I would like to turn it over to your host, Ken Tinsley, Splunk's Corporate Treasurer and Director of Investor Relations.

Great. Thanks, John.

Good afternoon, everyone. With me on the call today are Splunk's CEO, Godfrey Sullivan, and CFO, Dave Conte. This call is being broadcast live via webcast and following the call an audio replay will be available on our website. Hopefully you received a copy of the press release. If not, it's also available on our press release -- on our website.

On this call we will be making forward-looking statements, including guidance for our fourth quarter and fiscal 2014, use of our software, planned investments, customer purchasing patterns, trends with respect to the size and type of license sales and the resulting accounting treatment associated with such sales and the adoption of new products. These statements reflect our best judgment based on factors currently known to us and actual events or results may differ materially. Please refer to documents we filed with the SEC including the Form 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements.

These statements are being made as of today and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information. We will also discuss non-GAAP financial measures which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP to non-GAAP results is provided on our press release and on our website.

With that, let me turn it over to Godfrey.

Hello, everyone, welcome to the call.

Q3 was an exciting quarter as we expanded our product portfolio including Splunk Enterprise 6, our release of Hunk for Hadoop, our Enterprise Cloud offering, a new app for VMware, and a partnership with Amazon Web Services. Revenue for our fiscal third quarter was $78.6 million, up 51% compared to last year. License revenue was $50.9 million, up 47% compared to last year. We are delighted to welcome more than 450 new customers to Splunk and now have more than 6400 customers worldwide.

New and expansion customers include Tesla Motors, the NASDAQ, ING Direct, University of Sydney, Urban Outfitters, UCLA and Intuit. The story for Q3 is about widespread geographic success, Enterprise adoption, and a record quarter in our public sector. We closed several large transactions in the Department of Defense, in the civilian agencies, and state and local government, specifically the US Army, the US Air Force, the State Department, and Texas Health and Human Services Commission all significantly expanded their use of Splunk, a record quarter driven by security and operations use cases.

In addition to our success in the public sector, we also made progress with enterprise adoption of Splunk. This quarter Intuit, a long-time customer, made Splunk their enterprise standard with a multi-year enterprise adoption agreement. Intuit purchased multiple products, including Splunk Enterprise, Hunk, and our premium apps, enterprise security, VMware and PCI. Intuit already uses Splunk in many departments and this expansion will give them capacity for many more use cases, including customer analytics driven by quick stream and mobile data.

Quoting Tayloe Stansbury, the CEO at Intuit, Splunk software is one of the cornerstone technologies that helps Intuit continue to innovate and deliver the world's leading business and financial management solutions. Cornerstone technology is quite a compliment. We appreciate it and one that we strive to earn at every customer we serve.

One of our new customers is the NASDAQ OMX group. The CIO brought us in for security and IT operations for Directors Desk, an application that provides a paperless board room for secure information sharing among boards of directors. NASDAQ expects Splunk to increase up time, cut resolution times, and make the application more secure. In the future, NASDAQ expects to use Splunk to gain operational insight into user experience to drive product design.

As we expand our portfolio of products, we are investing in talent to drive the next phase of innovation. This quarter we announced the promotion of Stephen Sorkin to the position of chief strategy officer. In addition to scaling the engineering organization over the last eight years, Stephen has pioneered a number of inventions in Splunk software and currently holds 11 US patents. With deep technical experience and intimate knowledge of our customers, he's a great addition to our executive team.

We're also pleased to welcome Todd Papaioannou to the Splunk exec team as our chief technology officer. With his proven expertise in big data, cloud and open source, Todd will help define our long-range architecture. I'd also like to take this opportunity to thank Erik Swan for 10 years of innovation. Erik will continue to be an adviser to me and the team while he enjoys life with his family in Tahoe. That actually sounds pretty good to me.

One of the most fun things about working at Splunk is the innovation that our customers bring to us. A few examples from the Internet of Things from New York Air Break's presentation at Splunk Live Dallas last week, before Splunk they were stuck in Excel hell with monthly reporting of their control systems. Now with Splunk, realtime reporting of train events including throttle position, breaking effort, and fuel usage. Now they can ensure driver compliance, smoother travel, minimizing the in-train forces which wastes fuel and damaged goods. Interestingly, only 20 megabytes of data per month per locomotive, but with 18,000 locomotives running in the US alone, they tell us that 1% fuel savings can equal about $1 billion, so every little improvement matters.

Another Splunk life presenter from Multimedia Games out of Austin, before Splunk, manual log collection and monthly reporting from their business analysts; with Splunk, realtime collection of machine performance. The benefits, improved game placement, game profitability, improved service delivery, preventing down time, and improved decision making. To quote our customer, we are changing the way that we deliver gaming services, and we have evolved into making business decisions with Splunk.

And, finally, Ford Motor Company using Splunk to collect and analyze data from electric and gas powered cars, a few weeks ago Splunk employees hit the streets of San Francisco in a Ford Focus electric car and a gas powered Ford Escape. We used the Ford OpenXC, their API for cars, to gather, index, and analyze the data in Splunk. Analysis of acceleration showed that drivers are more aggressive in electric vehicles from a standing stop. I'm sure one of them.

The OpenXC API will enable Ford to better understand energy consumption and driver behavior and ultimately vehicle design, and to no surprise of any of us on P1s, Erik Swan received honorable mention in the press release for having the lead foot.

Now on to the product update; this was a milestone quarter for our product teams. First, Enterprise Version 6, our biggest release ever with more than 2000 new features. Version 6 brings the power of operational intelligence to more users through data models, the pivot interface, and high performance analytics store. Analytics are faster and easier for technical users and now more accessible to business users. The release of Splunk 6 was a key reason in Q3 that IDT corporation expanded their use of Splunk, making Splunk their company wide platform for operational intelligence.

IDP is a leading telecommunications and payment services provider that first selected Splunk for security and then expanded to IT operations in what their CSO likes to call Splunk usage creep. With the new pivot and data model capabilities in Splunk 6, IDT expects its business and marketing teams to be able to identify and target new markets leading to new revenue streams. They also installed a number of security apps including Enterprise Security, PCI, and the Splunk app for Palo Alto networks to defend against advanced security attacks and also for fraud protection.

Now on to the cloud, at our user conference we introduced Splunk Cloud, which delivers Splunk Enterprise as a cloud service for large scale production environments. We also announced that Splunk Storm, our cloud service for developers, is now free and since that announcement we have added more than 1000 new projects. White Ops and Funtomic are two beta customers who participated in the beta for Splunk Cloud and now have purchased Splunk Cloud in Q3.

Annual subscription plans are available from 50 gigabytes per day to 1 terabyte per day with custom options available outside that range. One of the strengths of Splunk is that customers can use it on FREM, in the cloud, or in hybrid environments. Building on that, we also announced an expanded partnership with Amazon Web Services. The release of the Amazon Machine Image, or AMI, for Splunk Enterprise and Hunk makes it easy for customers to use Splunk products in Amazon Web Services, and will soon have a subscription pricing model available for those customers.

This quarter we announced the GA of Hunk, a fully integrated analytics platform for Hadoop that enables users to interactively explore, analyze, and visualize historical data that rests in Hadoop. I spent the last several weeks on the road in Asia and hosted several CIO luncheons. None of those CIOs had Hadoop in production, and only a few of them were in the dev test stage.

All of them were thrilled to hear that Hunk can remedy these well known, long-term development cycles by delivering analytics in hours instead of months. More than 100 companies took part in the Hunk beta program and early feedback is universally positive. Hunk is available for a 60-day trial with no limits on the size of data or number of nodes.

Another milestone, Splunk made our first acquisition in Q3 when we acquired BugSense, a leading analytics solution for machine generated data for mobile devices. BugSense accelerates our ability to collect and analyze mobile data directly from the mobile hand sets. Their expertise in mobile combined with Splunk's platform will be a compelling combination for our customers. The Washington Post, one of our enterprise customers, integrated BugSense into three of their mobile application projects shortly after we announced the acquisition. The Post currently uses Splunk for performance analytics related to the video experiences for Post TV.

On to our premium apps, they continue to be a driver in many of our opportunities and the app for Splunk for Enterprise Security had its best quarter ever. The Erie Insurance Group is a new customer to Splunk. Erie is a Fortune 500 company that provides auto, home, life, and commercial insurance. With a high volume customer-facing website, Erie needed improved security for both internal and external threats. The security lead on the Erie project had come from Cisco, a long-time customer and partner of ours, so he knew us well and brought us into Erie knowing that Splunk had rapidly improved their security posture and deliver immediate value.

The US Department of Energy expanded their commitment to Splunk and standardized on Splunk for security at two different sites with our enterprise security app, replacing the legacy SIM vendor. The app also continues to receive industry recognition and was recently named best SIM by the readers of info security magazine.

Now onto the developer community, Splunk 6 introduced the Splunk web framework which helps developers quickly build Splunk custom apps. Both customers and partners are building new apps with this new web framework. We now have more than 450 apps on the Splunk website and we added about 25 new technology partners in the quarter. One partner, Thycotic, announced the Secret Server app to help identify insider threats. That is such a cool product name, I love it, Secret Server.

In Taiwan, our partner Systex announced SBOX, the first appliance built for Splunk Enterprise. SBOX is built specifically to maximize performance for Splunk. It's pre loaded with a lightweight OS and Splunk software and is ready for deployment out of the box. SBOX is now available for our A-PAC customers through Systex and their reseller network.

In closing, we'd like to thank everyone who attended our user conference in Las Vegas. Our customers presented some amazing material, and we always come away with being more energized about the future and also about the potential for innovative use cases still to come. My favorite quote of the quarter from a recent CIO forum, a fortune CIO said with enthusiasm, my team is drunk on Splunk.

Thanks again to our customers, our partners, and to our field organization, and now over to Dave.

Thanks, Godfrey.

Good afternoon, everyone. Thanks for joining us.

So, as you can see from the financials in the release we had a strong quarter, beating our expectations, and, obviously, I'm pleased with our performance and overall execution. Third quarter revenue was $78.6 million, a 51% increase over Q3 of last year, while license revenue grew 47%, totaling $50.9 million for the quarter. We saw more evidence of adoption and expansion of Splunk throughout our customer base, more than 70% of our license bookings again came from the existing customers in the form of upgrades and expansions. We also added more than 450 new customers, the most in any quarter, and recorded 207 orders greater than $100,000.

On the field side, we continue to build our capacity. We grew our quarter carriers from 189 to 204 during the quarter, about 58% of which were tenured 12 months or more as of October 31. We remain on track to end this year with approximately 220 field reps overall.

On our last few calls I have described enterprise adoption arrangements or EAAs. These structured transactions are typically larger orders and are intended to drive broad adoption of Splunk by providing our customers with a scalable Splunk license to enable them to expand their use cases. These transactions often contain elements which require them to be deferred and treated ratably in terms of revenue recognition.

In Q3, the Intuit order, which Godfrey detailed, was a seven-figure transaction, our largest in the quarter and was in EAA. Intuit has been a longstanding customer of Splunk, having deployed several terabytes of capacity over time. As they look to standardize their machine data on Splunk, we provided them a multi-year license which allows them to broadly deploy our products and have the visibility and predictability from a cost and budgeting perspective. Consistent with other EAAs, this transaction contributed to the overall growth in deferred revenue in Q3. EAAs have become an effective structure to drive Splunk adoption for larger customers and we expect more of these types of transactions, particularly in the back half of our fiscal years.

The mix between term and perpetual bookings has been highly variable based on customer buying preferences and we expect to see continued variability not only in this mix but also the number, size and timing of enterprise adoption arrangements. As I have said, the combination of term transactions and enterprise adoption arrangements could represent anywhere between 20% and 30% of license bookings in a quarter. Both of these types of transactions typically result in deferral up front and revenue recognized over time. As evidence of the variability of the mix, in Q3, 33% of total license bookings came from these -- from the combination of these types of transactions.

It's possible that this 20% to 30% range could increase even more, depending on how our customers adopt our new subscription products like Hunk and Cloud. Recall, we sell Hunk as an annual subscription consistent with the Hadoop distributions, and as you would expect, Cloud is sold as a subscription service. We also recently announced the availability of the new Amazon Machine Images, or AMIs, for Splunk Enterprise 6 and Hunk. Within the next several months we are planning to make these AMIs available to customers on a subscription basis. All of these product offerings will generate revenue ratably.

Now, turning back to the quarter, our maintenance renewal rate was 94% in Q3, the sixth consecutive quarter it's been greater than 90%. Customers also continued to utilize our professional services and educational offerings to accelerate adoption, which together represented 7% of revenue in Q3 consistent with past levels of 5% to 10%.

At our worldwide users conference last month in conjunction with the launch of Splunk Cloud, we provided an updated Storm service. With over 400 customers and more than 5000 projects, we announced that we would make Storm available to customers at no cost going forward. Developers can continue to benefit from Storm capabilities in their application development efforts now at no cost for the service. As a result of this conversion to a free service, accounting rules required us to take a non-cash charge for previously capitalized Storm R&D expense, which is included in cost of services on the income statement.

For consistent presentation of our Q3 operating metrics, we are excluding this nonrecurring charge, as well as non-cash stock-based compensation, employer payroll tax expenses related to employee stock plans, and BugSense acquisition-related expenses. Q3 overall non-GAAP gross margin was 91%, in line with prior quarters. Non-GAAP operating income was approximately $900,000, representing a positive margin of 1.1%, better than our expectations and reflective of our higher than forecasted revenues. Non-GAAP net income for the quarter was $400,000 and EPS was zero based on a weighted average share count of 118 million shares.

DSOs were on the low end over expectations at 63 days while cash flow from operations was $13.3 million. Free cash flow was $9.3 million, reflecting $2.5 million for our San Francisco headquarter expansion, and we ended the quarter with about $350 million in total cash. As we have stated, we will continue to run the business on a positive operating cash flow basis.

Looking forward, we expect Q4 total revenues to be between $88 million and $90 million with license revenues contributing about two-thirds of the total. As a result, we are increasing our full-year revenue expectation down, to now range between $291 million and $293 million.

Recall, and please note, that in Q4 of last year we booked a $20 million EAA, 100% of which was reflected in deferred revenue at the end of that period. When modeling deferred revenue for Q4 this year, you should consider and adjust for that transaction. Generally, it's better to look at deferred revenue on a sequential basis versus applying a year-over-year growth rate.

Consistent with prior years, we expect Q4 will be our most profitable quarter of the fiscal year. We expect Q4 non-GAAP operating margin to range between a positive 6% and a positive 8%. Combining our year-to-date results and Q4 outlook, we still expect full-year non-GAAP op margin to be about breakeven. Remember, because we expect non-GAAP profitability in Q4, you should use a fully diluted share count of about 120 million shares when calculating EPS.

With the expansion of our product suite including Hunk, Cloud, our apps and platform development, we're enabling our customers to adopt Splunk across organizations and realize substantial and rapid time to value from analyzing their machine data. Overall, Q3 was strong and I'm pleased with our results.

Appreciate all your time and now we welcome your questions.

(Operator instructions).

We will take our first question from Phil Winslow from Credit Suisse. Phil, please go ahead.

Thanks, guys. Congrats on another fantastic quarter. Godfrey, I know you don't like to use the P word, but we've always sort of viewed Splunk as having the potential to evolve into a data platform and I guess my question for you is when you kind of take the feedback that you got from dot-com when it came to Hunk or just the more and more just enterprise adoption agreements you're seeing, where do you think you are in sort of that progression from being a tool vendor to actually a data platform, and then I just have one followup to that?

Well, gosh, I guess I was the guy in the Company that was the hardest on everyone to not use the platform word and it really came from the early days when the Jeffrey Moore gang came over to see us and kind of cautioned us about trying to grow from a tool to a solution to a platform and back in the days when we were wildly seen just as a query tool for launch, to use a platform terminology would be just jumping levels and getting way ahead of ourselves, so I was pretty hard on the Company and say, guys, don't use that term until customers use it, but once customers start to acknowledge that you're a platform, it's probably okay to go ahead and say it. And so this was probably the year, 2013 specifically is the year when I've said, okay, it's probably okay for us to call ourselves a data platform now because all of our customers do, so you can call that resistant or overly conservative marking if you want but I kind of felt like it needed to be true before we said it and I believe it's true now.

Got it. And then just a followup for Dave. Dave, one of the questions we get is about (inaudible) this year and then how it affects sort of next year's license growth. Maybe you could help us walk through how long it takes to bring on reps and then sort of -- obviously, you're not giving next year's guidance but how we should sort of think about the effect of that and also I guess a followup for Godfrey, too. One of the things you did mention at [dot-com] was potentially starting up some relationships with systems integrators which is obviously not a -- has not been a big channel for you guys in the past,. How do you put all those together when you think about the tie between quarter [carrying] heads, systems integrators and license growth?

Yes, Phil, thanks. We obviously measure time to productivity for our reps every quarter and it's still over globally is 9 to 12 months before we see new folks becoming what we call fully productive. I do think some of the challenges that we are evaluating in terms of how that metric moves or how that time to productivity changes is moving from single product to multi product. So, with the introduction of Hunk now going directly from the field with Cloud, adding premium apps like VMware, how will these extra skill sets that we need to get, spread through the field impact that time to productivity. Only time will tell but as we look forward and build our own model, we're still using the 12 month time to productivity metric.

To the second part of the question around the SIs. Well, this has been a long -- this is like the platform word because this takes a long time in a market such as ours for this to come about. One of the core strengths of the Splunk company and the product is that it downloads easily, it deploys easily, and provides immediate value and that's generally not consistent with how SIs make money given that they tend to make money from large scale integration projects and heavy, heavy resource implementations, and Splunk just hasn't been like that.

It's only now and more recent times, I think in Q3 one of our large orders was actually with a partner, with an SI partner, in general it's taken a while for this to come around because you need to grow inside of a customer to a pretty large foot mark print, I would say to a platform footprint before the integration word, the connectivity to other data sources and databases, the dashboards and reports and alerts and all those mechanisms that are getting built, gets to a scale of where an SI can make money off of it, so I think we are starting to reach that but it is still only at our largest customers that we see that intersection taking place. For the most part it's still a web model driven by outside salespeople, inside salespeople, the web, and regional bars but I think we will get more business from SI partnerships as time goes on.

Great. Thanks, guys and keep up the good work.

Thank you.

Thank you. And our next question comes from John DiFucci from JPMorgan. John, please go ahead.

Hi. This is actually [Sindeep Madure] on for John. I guess kind of a follow-up to Phil's question, just if you could talk a little bit more about the momentum you're seeing in some of the larger deals as you're signing, clearly, I guess over 207 this quarter versus 163 last quarter and the trend seems to be getting better, and also if he could talk specifically about the public sector and what you saw specifically in this quarter for the record kind of public signings that you had?

Sure. Hi, Sindeep, this is Dave. Clearly, we're very happy to see the results in terms of the number of large transactions topping 200 for a quarter for the first time greater than $100,000. Interestingly, though, our overall ASPs remain consistent over the last three years and that's been anywhere between $30,000 and $40,000. Obviously, that's just math. The overall amount of business that we're generating transactions below $100,000 milestone have been growing equally, so we do see customers making larger purchases as they become more familiar with the product and they move from single department to multi-department and they gain that value in terms of correlating multiple data sources together. I think that's a big component of it.

And then, importantly, I think it was probably three years ago we started a transition from primarily an inside sales team to one that's now two-thirds weighted to a direct sales team, so we are getting higher in an organization and the awareness of what Splunk is doing and the value that we bring is becoming more prevalent in the market.

Great.

To the federal question, Sindeep, I guess as a prelude I think our field organization just did an exceptional job this quarter all over the world, so it was strong commercially everywhere. Fed was particularly strong, really driven by the security use cases, so whether it's the [mandate] report or need for just better visibility or additional forensics, Splunk is really emerging as the standard for how they want to do forensics and so our team and federal just did -- and state and local was actually quite strong there as well.

The difference was in state and local some of the use cases tend to be a little bit more classic IT ops where federal is a little bit more heavily weighted towards security use cases, but I just say all in all it was great execution driven by a strong demand in the government sector for security.

Great. I guess just a quick follow-up to that as well. I think in the past you've mentioned that the core use cases still account for about 90% of the total deployment of Splunk with regards to IT ops and security. I was just wondering with regards to sort of the more beyond use cases what do you need to see or what needs to happen for you to get a better sense of that use case is going to be more than sort of a 10% use case because it seems like you have the product integrations, it seems like Splunk Enterprise 6 is also easier to use, you're addressing a broader audience of consumers but just if you could maybe talk to that, that would be great?

I agree. In fact, I think 2014 will be the year where we really start to see that accelerate. We may not talk about it as much as perhaps we should just because a lot of the initial purchases for us tend to be either in the app management, IT ops or security use cases but they all grow from that point to becoming a business analytics use case, so my example about the gaming company out of Austin, they started using us for infrastructure and diagnostics around their gaming machines and found very quickly that they could use us actually to determine where to put the machines, which ones were most popular and how to make those systems perform better, so when they talk about using Splunk for business decisions, it was an outgrowth from the original sort of IT use case into a business use case and we see that in almost every one of our large scale customers.

So, maybe we need to explain -- it's a hard thing to explain from the standpoint of what happened first, so -- but I think 2014 will be a fascinating year in terms of growth and the business analytics, web intelligence areas because Splunk 6 gives an easier interface to get that done through the data models, the pivots, the high performance store all that stuff is really aimed right at that sort of operational analytics business. So, good question. We will try to do a little better job explaining more of how those use cases are coming about as we go into the future quarter calls.

Great. Thanks.

Thank you. And our next question comes from Heather Bellini from Goldman Sachs. Heather, please go ahead.

Great. Thank you, gentlemen. I have two questions. One, I wanted to ask what you make of Amazon's recent Kinesis announcement from their conference last year week and, two, can you share with us the uptake in the quarter of Splunk Cloud and how you see this as a revenue driver for calendar 2014? Thank you.

Yes. Hi, Heather. Godfrey here. Well, Kinesis is good for everyone because it gives more companies exposure to their logs so just like sales force publishes their logs and customers can get access to it and we do a pretty good job of analyzing those, it's really important that more and more writers begin to publish those log formats.

I didn't talk about it on the call but we also improved the release and improved version of the Splunk app for Amazon this past quarter and our customers love it because you can point that app uphill at your Amazon instances and get better day-to-day reporting on which ones are actually running workloads and which ones are sitting there chewing up cycles that you're paying for that actually aren't doing any work. So, there's a lot of interest in this whole Amazon to Splunk connectivity and we plan to capitalize on it, not just our AMIs but actually just better presence overall.

To the cloud piece, I think it's quite early there still because the sales cycles for those larger deployments, these are operational use cases we are deploying, really not any different than Splunk Enterprise. They just happen to be running in the cloud instead of on front and the customers want to load up the data sources and try to -- try it out and see how it works and the POCs that we're running right now look an awful lot like our core business but they are running somewhere else and customers are excited about it and we have a lot of very interesting projects in the pipeline. I think after the next -- I think next quarter's call will be a better time to do a readout on that because we just announced the service a few weeks back.

Thank you.

Thanks, Heather, and thanks for your work on your initiation fees. Next question, please.

Okay. Thank you. And our next question comes from Brendan Barnicle from Pacific Crest Securities. Please go ahead, sir.

Thanks so much, guys. Dave, had one for you. You talked about larger percentage of revenue, 33% I think you said, coming from enterprise agreements that was larger than you expected yet you still had strong revenue upside. Is there a way to determine what the additional revenue you might have seen that ended up perhaps being deferred because you ended up at 33% say as opposed to maybe like the midpoint of your range at 25%?

Well, I mean, you obviously can do the same calculations that we can in terms of derived bookings and it's ultimately geography, Brendan, between revenue and deferred. I think we give the metric of 20% to 30% because we continuously talk about this variability in terms of with the combination or the mix of how a customer purchases a product term, perpetual, and what we consider more strategic these adoption transactions, enterprise adoption, so at this absolute level any small set or in some cases as in Q4 of last year when we recorded a $20 million transaction, any small set or individual transactions that are large can skew that percentage and I think that's certainly the case this quarter, but if you look at all of the financial metrics, and I mentioned it in my opening statement, we exceeded our own expectations for the quarter and I think that's reflected in revenues deferred and of course what you can calculate in terms of derived bookings metric.

And then you gave us the number of deals over 100,000, but I don't think I caught the number of deals over a million. Did you provide that this quarter?

Did not. The last time we gave the metric was on our Q4 call. It's something we will consider doing again but not a recurring metric we are providing on a quarterly basis.

Great. And then lastly, Godfrey, you obviously gave a lot of examples today about improvements in business analytics and web analytics use cases yet that's still a pretty small minority of overall uses. How much do you think those use cases could ultimately become as a percentage of business as we think about the business longer term?

It's equivalent to any of our other core segments. If I were looking out several years, I think you'll see an evening out of use cases between what I would call operational analytics all up and out including web type use cases, internet of things, security, IT operations and apps. If I had to look out multiple years I would say there would be five key segments that are all relatively similar in size; therefore, the analytics segments and the IT -- and the internet and things segments are likely to grow faster even than our core segments.

When you have these platforms transactions, they don't -- we don't track them against one use case so it sort of dilutes the way you track your segments when a customer does a large standardization beyond Splunk to what do you attribute that, so there's a little bit of rocket science that goes into trying to figure out all this segment information. It is not a pure mathematical exercise, but I do believe that those other two segments will be as large as our core segments today.

Great. Thanks, guys.

Thanks.

Thanks, Brendan.

Thank you. And our next question comes from Keith Weiss from Morgan Stanley. Keith, please go ahead.

Excellent. Thank you, guys, for taking the question and outstanding quarter. I wanted to dig into that 33% of -- and to be clear of licensed billings from terms, so it's not just EAs, term and EA? Is that correct?

That's right. Keith, it's the combination.

Right. So, that has been tracking in the high teens. The year-to-year date I think 16%, 18% over the last two quarters and up significantly from where it was last year which I think was high single digits, so that implies that your license billings growth was a material acceleration this quarter. Is there one in particular, one side of that equation was it just sort of like a bump up in EAs really just that big or did you see just more in general term business going on in the quarter as well?

Well, I mean, if you turn back the clock I used to complain about the variability quarter to quarter of the stand-alone term contribution, hence what was previously a 10% to 20% range and sometimes we bounce outside of that. Now, adding the adoption transactions and the term together to give better visibility to you guys in terms of how you're forecasting revenue, we upped the range to 20% to 30% and for the first time we reported it after initiating that range we bounce outside of that. Again, highly dependent on individual transactions. What I will say about the stand-alone term business is it was -- I'm making a statement that it is inconsistent on a quarterly basis, but it was in the upper teens and has been generally I would say for the last three, four quarters.

Got it. Got it. That's helpful. And then in terms of the services business, you saw a really nice sequential uptick in services business this quarter, it was up 17%. In the guide if I take the two-thirds of the midpoint of your guidance it seems like that ticks down a little bit in terms of sequential growth, 9% sequential growth. Was there anything in particular, anything we should be aware of in terms of maybe one-time items that occurred in that services line in 3Q that causes that down tick into Q4?

No. Q3 tends to be our seasonally highest services quarter and it correlates to our users' conference where we deliver a fair amount of our educational services to customers.

Okay.

We have almost 2000 of them captive this last year. And it's been a trend we've experienced the prior year as well where Q3 had an uptick in services revenue tied directly to educational services at dot-com.

Got it. And then just one last one for me, more strategic high level one. When we talk to people in the field and in the industry, it seems like Splunk has hit something of an inflection point in terms of the security business such as people being really positive of and sort of really look at Splunk as [a real security] player now. Is there anything in the product in particular, maybe Splunk 6, that really sort of turned the dial or sort of created a catalyst or an inflection point for you guys in that security business?

Well, my sense of that is that it took the marketplace a while to sort of get from the yesteryear which was a rules engine that told you when something bad happened and that was kind of the definition of an old SIM. And with advanced persistent threats, insider threats, all this other activity going on, the market has begun to shift towards having a very flexible forensics engine that can search massive amounts of data over long periods of time, and I think it was really the RSA conference of two years ago, not this February but last, where we kind of became the darling of the show and everybody was talking about this sort of the old SIM is dead, the new way of doing it is sort of this analytics, forensics search definition and since that time our business has continued to strengthen. So, I think we are finally getting some recognition that it really is about the search capability that makes it so powerful and then now having a good app on top that kind of gives you the best of both worlds.

You have the forensics capability of the engine, you have a really fine app on top that gives you the reporting and analytics that you need, and then you have the kind of tailwinds of it's been a really bad marketplace out there this year in terms of attacks and disclosures and information and it's put a little bit more pressure on organizations to make sure that their search posture is as good as it can be, so I think it's kind of a combination of all of those things and it continues to be very healthy, but Splunk has a reputation in the security market now that we certainly didn't have two or three years ago.

Excellent. Again, outstanding quarter, guys.

Thank you.

Thank you.

Thank you and our next question comes from Brian White from Cantor Fitzgerald. Brian, please go ahead.

Yes. Hi, Godfrey. Just got a question on products. You're essentially moving from a one-product company to a multiple product company and I'm just curious how you think about revenue distribution, so Splunk Enterprises majority of your revenue today, I would be curious of where you see sales outside of Splunk Enterprise in say 12 to 18 months because you've got cloud which is enterprise in the cloud, Hunk, BugSense and obviously you have Storm, so if you could just give us a view of how we should think about some of these new products as a percentage of revenue?

I don't know. I haven't been very good at forecasting that just yet. The -- it's like I keep saying that pretty soon the international markets will be a much higher percentage than the domestic because smaller numbers will grow faster than larger ones and yet here we were again for several straight quarters where international is still 21% of the business because domestic keeps growing so fast.

So, let me answer your question with a disclaimer that I seem to be a pretty lousy forecaster and that would be that if you just use logic it would tell you that some of these new entrants are going to grow on a percentage basis faster than the core product and, therefore, they should start to capture a larger and larger percentage of our revenue and that's how typical product diversification works. I guess I'll have to let those products prove me out there because they have some catching up to do.

Okay. And how about the public vertical? Obviously it sounded like federal was very strong. Just to remind us what is public as a percentage of revenue for Splunk?

Well, we don't disclose that but it's comprised of the DOD world, the civilian agencies, and organizationally also state and local, all that rolls up into one team, East Coast our DC ops, but we haven't actually broken that out.

Okay. Can we assume though it's over 10%? Is that fair?

Bigger than a bread box. Dave, what would be the --?

Obviously it bounces, as you would expect, and our Q3 crosses the federal fiscal year end so Q3 our public sector always contributes more than it does any other quarter and has a greater percentage of its contribution in that quarter relative to the rest of the year. If you look at the whole year, it's certainly doing well as an individual region for us, but no more so, as Godfrey mentioned, as all the other regions.

Congrats on a great quarter.

Thanks very much.

Thanks, Brian.

Thank you. And our next question comes from Aaron Schwartz from Jefferies. Aaron, please go ahead.

Good afternoon. Thanks. You talked a little bit here on past calls about the expansion and the existing base here on the enterprise adoption side and I was just wondering as you look at the business at all, can you talk about what you're seeing in terms of capacity expansion in terms of growth as the renewals come up and then sort of as a follow-up there as you see customers start to add the premium apps, how do you think about that expansion over time with the addition of the premium apps?

I don't have any stats at the ready in terms of how much of our -- when our renewal team is engaged with a customer, how often does a renewal turn into an expansion. That's an interesting question. Let me go off-line and do a little staff work on that. I will tell you anecdotally that I think it's frequently that there is some noticeable fraction of conversations where a renewals person has been in touch with a customer all year long. We don't call them just 30 days before the renewal.

We try to make sure we have a relationship all year with that customer and oftentimes the renewal of the maintenance agreement is where the customer is kind of making a mental decision about whether just to renew maintenance or whether to buy some additional license capacity at that time, and then we have all the [code term] issues and whatever else and buy a license and change the maintenance, but I don't have actually a good stat on that, so let me take that off-line and I'll see if we can address it next quarter's call. That's an interesting question that I don't have a ready answer on that. What was the second part of the question?

I was just saying sort of related as you see more customers adopt your premium apps, what's the influence you would expect there on the capacity growth so -- probably related to some of the digging you're doing there, I would assume?

Yes.

Okay.

We hope that apps and platform together make for a pretty synergistic combination, the customers will be happy and sometimes an app can be dropped right on top of the existing platform with no revenue impact whatsoever. That is the core license is big enough that whenever an app is dropped on it and brings in some more data sources and causes some more daily indexing volumes, there's no impact. Sometimes it requires more license to run that app because they are already at capacity for the other work that they are doing, and so it's not unusual at all for our field organization to engage a customer with the solution being the app and it drives additional indexing capacity along with it, but there's not a rule of thumb that says one -- a dollar of this drives a half a dollar of that or something. It kind of depends on where the customer is starting from relative to core capacity. So, I wish I had a better answer for you than that. Our marketing department would love to know the answer to that question but I actually don't know the answer.

Right. Okay. And then maybe a question for Dave on the EAAs. I know in October user event the way you sort of characterized those it didn't seem like there was a standardization deal, still very unique and you're still very early into this. How do you think about that over the next couple of years? I mean, I would assume you would get to some standardization on how these are getting done. I don't know if that's true or not, but is there anything you guys are doing internally here to drive to a little bit more to where each EAA is not really a unique different case customer by customer? Thanks.

Yes, Aaron, I certainly hope and expect that if you're looking 12 to 24 months down horizon that we will have a more, I'd say, formulaic and repeatable rhythm to how we're doing adoption transactions, that's going to require us to put some mileage in the rear view mirror in terms of having more than a couple handfuls of these deals today. So, in answer to the first part of your question, yes, each one is still, I would say, a unique experience between us and the customer driven as much by one of an individual customer characteristics as it is the way we would like to structure the transaction. Ultimately, our guiding principle and how do we enable adoption of the platform and we want to do that in a way that is effective for the customer for sure.

Okay. Thank you.

Okay. Thanks.

Thank you and our next question comes from Raimo Lenschow from Barclays. Please go ahead.

It's [David Wang] on for Raimo. The first question is if we go back to the 220 quarter rev guidance you gave, that implies about 35% year-on-year growth which is quite a deceleration from last year. I was wondering how you reconcile that with the sort of greenfield market opportunity you see? Well, I think the component of revenue that's changing, that we have -- I think been pretty -- hopefully pretty transparent in terms of how we set expectation is the composition of bookings is changing from what I consider traditional perpetual up-front rev req to combination where a lot -- you'll see a lot of transactions being deferred and if you -- it's really a geography question. Is it going to hit the income statement or is it going to hit the balance sheet?

So, as we look forward and we think about not just what has been our traditional term business, I think Keith's earlier point, now the combination of term and adoption transactions being anywhere from 20% to 30% of license bookings in a quarter plus the introduction of multiple products that are traditionally sold and our intent of course is to sell them as subscriptions, we see from a forecast perspective greater percentages of the business being recognized ratably than they would be up front which would have been the case say even as two years ago. Right, right. And, secondly, are you seeing more startup competition in the marketplace, someone like [Consumer Logic] for example I think has been making a bit more noise.

No real change in the quarter. We're all in the competition. We still see all the same players and all the same segments, so if it's security we've got a posse (inaudible) chase us around in that segment, and if it's infrastructure or applications or business analytics or what have you including cloud, so no real change, just same folks showing up and we are all under the same circumstances. Hopefully we are winning a lot more than we are losing.

Great. Thanks a lot.

Thank you.

Thank you. And our next question comes from Ed Maguire from CLSA. Please go ahead.

Hi. Thanks a blot. Good afternoon. A bit of a twist on the last question about competition. Are you seeing any change in the incumbent software solutions that you may be replacing with some of the use cases, particularly in security? I know a couple of quarters ago, Godfrey, you had really mentioned you were starting to see that inflection there.

We knew it was, Maguire. Feel good about it. I did mention on the call one of our federal customers who used Splunk plus the Enterprise Security app to replace existing vendor at two of their locations so, yes, you would -- yes, there is still that activity going on, Splunk is being used to -- customers would rather have Splunk as the data platform and know that one of the use cases is security than they would to buy a SIM and only have a very narrow set of use cases so, yes, that train is still rolling.

Great. And just a follow-up more broadly. As you look forward over the next year or two, in terms of where you plan to invest there's an enormous amount of momentum around the applications and you've got a lot of partners building apps, but where do you see maybe incremental investment on the development side? Are you going to just continue to double down on the platform and look at more data sources, et cetera, or are -- or do you see an acceleration on your part in building out more applications, paid applications?

We need to do three things. One is, -- well, we need to do about five things. Ed, we need to make it easier for developers to build apps because we can't build everything ourselves so we have to continue to evangelize and develop our ecosystem and the web framework that we shipped in 6 is a good start in that direction because it uses [Jango] and other really standard web desk tools, HTML and the like, so it's a lot easier for developers to make nice, beautiful applications on the Splunk engine and using all of the standard tool sites so that's one thing we have to do.

Another thing we have to do is continue to build a few more apps ourselves because there is a whole product notion in each of the markets in security and IT operations and apps and business analytics. It takes more than just a great engine to deliver value to the customer. It takes a whole product that includes some content and some work flow and all that sort of thing so, yes, we have to personally invest in more content on top of the engine around those segments, and I think there's a whole set of different issues which is how much can we just simply not get done and the BugSense acquisition is an example of where sometimes you have to use your balance sheet to go get some things that are build versus by decisions and that's a good example where we took someone that has great technology, they're already on half a billion mobile devices in terms of their [forwarder]. Good example of the place where you go ahead and make an acquisition to help accelerate your road map. So, I kind of think of it in those three buckets.

Great. Thanks a lot.

Thanks, Ed.

Thanks, Ed. John, we have time for one more question, please.

Thank you. We will take our next question from Steve Koenig from Wedbush Securities.

Thank you for taking my question. I'm curious about Splunk Cloud. Remind me first, are apps running in the cloud and then do you expect the cloud deals to become more app driven than Splunk Enterprise? And related to that, does the cloud open up new opportunities or is it more of a customer either/or decision between enterprise and cloud?

Cloud is a pretty open-ended question when it comes to a customer conversation, so what we really want to do is enable a customer to run Splunk wherever they want to run it and that could be on [prim], in the cloud, in a multitude of cloud options, or a combination of prim and cloud. So, really our strategy is to put Splunk wherever customers need it.

Now, just think about a couple of ways they can do that. One is they can run Splunk Enterprise on prim, they can run Splunk Enterprise itself in the cloud. We have some very large customers that run in cloud environments like on somebody else's infrastructure. We now have Splunk Cloud as a service that we will host for you on a given specific use case and that could be security with enterprise security on top of it. It could be in an IT operations case where we're putting things like the Palo Alto networks or VMware or Microsoft content on top.

So, that's an option and now we just announced Splunk as an AMI so that customers can go up and download Splunk in an Amazon virtual instance and run it immediately there. So, yes, apps can run in all of those -- in all four of those examples so, yes, we expect for the platform to be available in as many places and ways as customers want to suggest it and we would like to make as much content as possible available in each of those, in this case, four examples.

Great. Thanks, Godfrey and congratulations on the quarter, guys.

Thanks.

Thanks, Steve. John, that's our final question. So, thanks, everybody for joining us today. We appreciate it. Hope you have a good evening and hope everybody has a good Thanksgiving.

Okay. Ladies and gentlemen, this does conclude your conference. You may now disconnect and have a great day.