Splunk Inc (SPLK) 2014 Q4 法說會逐字稿

Good day, ladies and gentlemen. Welcome to the Splunk, Incorporated, Fourth Quarter 2014 Financial Results Conference Call. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session. Instructions will follow at that time.

(Operator Instructions)

As a reminder, this conference call is being recorded. I would now like to turn the call over to Mr. Ken Tinsley, Splunk's Corporate Treasurer and Director of Investor Relations. Mr. Tinsley, you may begin.

Thank you, Bridget, and good afternoon, everyone. With me on the call today are Splunk's CEO, Godfrey Sullivan, and CFO Dave Conte. This conference call is being broadcast live via webcast. Following the call, an audio replay will be available on our website. Hopefully you have received a copy of our press release. If not, it is available on our website.

On this call we will be making forward-looking statements, including guidance for our first quarter and fiscal 2015, uses of our software, planned investments, increasing enterprise adoption of our products, market opportunities, expected benefits of our acquisitions, and the adoption of new products. These statements reflect our best judgment based on factors currently known to us, and actual events or results may differ materially

Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures which are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and our website. As a brief reminder, we will be holding Splunk Live events on the East Coast in May. We'll be in DC on the 7th, and New York on the 15th. Registration for these events are available on our website. With that, let me turn it to Godfrey.

Thanks, Ken. Hello, everyone. Welcome to the call. Q4 was a strong finish to a memorable year at the Company. I will talk numbers in just a moment, but I have to tell you that in preparing for this call and assembling all of the information, it was a reminder of how this business is built on one thing, and that's customer success.

We're so honored to have the passionate support of our customers, our employees, and our partners. We're already going flat out into FY15 with kick-off meetings, marketing events, TBRs and all that. This earnings call has been an opportunity to reflect on a really remarkable year, because it's just so packed with customer success. I'm happy to have the opportunity to do this read out.

First and always first, we are delighted to welcome more than 500 new customers. We now have more than 7,000 customers worldwide, including more than two-thirds of the Fortune 100. Revenue for Q4 was up 53% compared to last year. License revenue was up 47% compared to last Q4, and we finished with full-year revenue at just over $302 million, up 52% from the prior year.

Thanks again to our customers, we received a record number of six- and seven-figure orders, with a good mix of new and expansion business. One of the things I enjoy most, and I know our investors really appreciate, is hearing all the innovative ways that our customers are using our products.

A few examples from Q4. One of our large customers is analyzing the position and performance of fuel tankers on some of the world's most dangerous roads, proactively monitoring for speeding, illegal fuel transfers, break-downs, and hijackings. A large US government contractor is using us to analyze sensor data from industrial facilities to prevent dangerous accidents in handling hazardous materials. I wish I could tell you more about this one, but this use case just can't be discussed further. Volkswagen AG's Big Data Lab has chosen us to demonstrate the value of the data that can be analyzed and visualized in real time from their next generation of electric vehicles. Volkswagen will demo this solution at CeBIT 2014.

In our core markets, we had multiple examples of enterprise adoptions. Comcast, one of our long-time customers, expanded their use at Splunk to analyze more than 100 terabytes of data to support their X-1 platform from Xfinity. If you're interested in seeing this use case, go check out their presentation, which is available on the Strata website. General Electric, a long-time customer, agreed to a multi-year agreement in Q4 that made Splunk their platform for operational intelligence. GE relies on us primarily for security, but now plans to expand to multiple use cases across a variety of departments.

Etsy, a really cool market place for handmade goods, signed a multi-year agreement using Splunk to analyze shopping behavior and customer experience. MLB Advanced Media, which is the interactive media arm of Major League Baseball, signed a multi-year enterprise agreement for IT system monitoring and customer analytics.

Under products, our expansion from a single-product to a multi-product Company is giving us new use-case opportunities, and increasing adoption by our customers. We launched Splunk Enterprise Version 6 at our user conference in October, and it continues to be a key driver for customer expansions. Live Nation, a leading concert promoter, expanded their license in Q4 for digital analytics across their e-commerce properties, including TicketMaster.com.

While Splunk Enterprise is well known as a data platform that scales to many terabytes, we also have a strong customer base at lower volume levels. To this day, quite a few of our new customers graduate from the free download to a small paid license. I'm very pleased to report that we have just announced new pricing for entry customers that doubles their data volumes at existing price points. As data volumes grow, we want to make it easier for customers to start with Splunk and grow with Splunk.

In Q4 we released the ODBC driver, which provides industry standard connectivity between version 6 and third-party analytics tools such as Excel and Tableau. Our ODBC driver enables business users to easily combine machine data with structured data to support business analytics use cases. Since launching Splunk Cloud, we're seeing early success among customers who want the power of Splunk Enterprise delivered as a cloud service. In Q4, we signed agreements with both large and mid-size enterprises.

Example, a large financial services organization that committed to a multi-year agreement and sending a half terabyte of data per day to Splunk 5. We're the only operational intelligence vendor that enables customers to run on prem, in public or private clouds, through NSPs or purely as a service.

Hunk, which you know as Splunk Analytics for Hadoop, was launched in late Q3, and has received strong market interest. We built a significant sales pipeline mostly in the US, northern Europe and Australia. In Q4, the Capital Group, one of the world's largest private investment management companies selected Hunk, along with other Splunk products for operational analytics.

One of my favorite e-mails of the quarter came from our ask sales forum where a customer from the UK said and I quote I downloaded the Hunk free trial and installed it yesterday on top of Hadoop. Hortonworks put me on to you guys, to be honest I'm truly stunned what I have seen already. When can I get on the phone with presales to find out more? So this was a customer who downloaded it and had value out of it in 24 hours.

We have a healthy pipeline of Hunk opportunities as a result of go-market activities with our partners, Hortonworks, Cloudera and MapR. Noteworthy is that the sales cycles for Hunk appear to be about the same as Splunk enterprise, that is anticipating something like a range of six to nine months.

On to our premium apps. Our continued investment in apps is driving more value for our customers, and more use cases for us. This quarter, we announced the latest version of Enterprise Security 3.0. A leading hospital network selected Security 3.0 to help the hospital protect patient privacy and improve their overall security posture. The functionality in this app including NET 4 analysis and [swindling] based threat visualization, was key to their decision.

At our user conference, we introduced version 3 of our Splunk app for VMware. And in Q4 we closed more than 30 opportunities, including customer wins at Erie Insurance Group, [Brooks Post] and John Lewis. This app recently won the editor's choice award in Virtualization Review magazine.

We will continue to invest heavily in our internal product road map, lots of stuff in the pipeline, and we'll also expand by acquiring technologies that accelerate our time to market. This year we made our first two acquisitions. BugSense in Q3, and Cloudmeter in Q4.

Cloudmeter's technology enables customers to capture data directly from the network. This network data typically contains more fields than logs, and Cloudmeter has outstanding technology to integrate with Splunk, supporting even more use cases. Our integration with BugSense which will enable direct access to data from mobile devices into Splunk is also going well. Looking forward to providing more details on this over the course of the year.

Now to developers. We're committed to supporting corporate developers who want to build apps in their languages of choice. In Q4, we launched our Eclipse Plug-in for Java developers. We now have SDKs covering six major programming languages, and a web framework to accelerate development. Customers such as Apollo Group, Cobalt and SNAP Interactive, as well as partners such as Cloud Passage, Wipro, Prelert and Function1 are all using our developer tools to customize and extend the power of the Splunk platform.

On to our partners. We're really proud of our partner ecosystem including resellers, technology partners, GSIs, MSPs and OEMs. They're extending our reach across all markets. This quarter we entered into an alliance with Internet 2, also known as I2, a consortium of major universities. This subscription agreement sets up pre negotiated contract terms and pricing, to make it simpler and faster for hundreds of education customers around the US to adopt Splunk. Within 24 hours of signing our agreement, I'm happy to tell you that Baylor became the first university to purchase a Splunk enterprise subscription under the program. Go Bears.

A few words about our OEM partners. They typically build solutions that embed Splunk into their own product offering. For example, CrowdStrike announced the availability of end-point activity monitoring, an application built on their Falcon platform that embeds Splunk for the search and analytics of CrowdStrike data sources.

Global SIs, Accenture and Wipro each helped us close multi million dollar opportunities in Q4. Thanks to both companies for great team work. We recently launched a joint go-to-market initiative with Cisco to focus on simplifying and accelerating threat visibility with Splunk and the Cisco identity services engine. We're supporting Cisco's application centered infrastructure campaign. Earlier this month, demoed the Splunk app for ACI at a packed booth at Cisco Live in Milan, with more cities to follow.

We're working closely with other key partners such as Palo Alto Networks, where we are conducting joint go-to-market activities, including an upcoming 20 city road show with Palo Alto and our top security channel partners. In Q4, we announced our partnership with Amazon web services. And we now have the free versions of Hunk and Splunk Enterprise available as an Amazon Machine Image or AMI on the AWS Marketplace. We plan to introduce paid versions later this year. Those will most likely be available as monthly or annual subscriptions.

Finally, on to our markets. These include app management, IT ops and security and also our emerging markets such as digital analytics and the Internet of Things. Orange France, the largest provider of e-mail services in France, will use Splunk for application management and track spammers and phishing for over 12 million active mailboxes. Chevron Australia is a new customer to Splunk and will use us for IT operations to improve operational visibility. As a part of this, they bought our app for VMware.

Symantec selected Splunk as their platform for security investigation. Symantec will centralize, monitor and analyze all security related data in Splunk Enterprise so their security teams can better investigate incidents and detect advanced and insider threats. They will also use Splunk to ensure compliance with SOX and PCI data. Finanz Informatik, a German financial IT services provider is also a new customer. And has standardized on Splunk as their platform for operational intelligence. FI supports more than half the banks in Germany and will centralize, monitor and analyze all security related data.

John Lewis, one of the biggest retailers in the United Kingdom has significantly expanded their use of Splunk in Q4 for business analytics. Over the holidays, online sales at John Lewis increased 23%, and Splunk was a key factor in helping them make annual sales, promotion, and marketing decisions.

As our markets grow, we need to better organize the Company to support them. For example, about a third of our business and our customers use Splunk for security. Our Enterprise Security 3.0 app just had another record quarter, and the 451 group just named us as one of the top four global security [lenders]. Gartner just recognized us with another key security segment for fraud detection. And Government Security News just named Splunk Enterprise as the best big data analytic solution. So things are smoking in the security market.

But to better support this growth, we're evolving from a purely functional work structure, to one that includes market segment teams. We recently announced that Haiyan Song, former VP and General Manager at ArcSight-HP has joined Splunk as the VP of Security Markets. Haiyan will be responsible for all aspects of our security plan, including product direction, go-to-market activities and much more.

This is an important change for us and our next market group will be IT operations, and then we will keep moving. By forming these new teams, it enables us to accelerate value in our core markets, and also gives us more bandwidth to pursue new and emerging markets.

As I look ahead towards to FY15 I believe it will be the year of enterprise option. We've laid the ground work for this over the last year by making customer expansion easier through enterprise adoption agreements. By evolving from a single product to a multi product Company, by acquiring companies and their technologies to enhance the value our products deliver to our customers, and by building an ecosystem of partners. So as always, I want to thank our customers, our partners, and our employees for making Splunk such a fun place to work. Now over to Dave.

Thanks, Godfrey. Good afternoon, everyone. Thanks for joining us. As Godfrey mentioned, Q4 was another record quarter for Splunk. We're certainly pleased with all of the progress on the products front, and our field organization's execution in the quarter led us to significantly exceed our own plan.

Fourth quarter revenue was approximately $100 million, a 53% increase over Q4 of last year. License revenue grew 47% over last year, totaling approximately $69 million. For the full year, revenue grew 52% to more than $302 million in total, of which about $200 million was license revenue, a 46% increase over last year. On our past calls, I've talked about our focused investments in product development and field expansion to drive adoption of Splunk software, and I'm pleased with our progress so far.

Specifically on the product side, we entered the year with our core enterprise products and apps. During the year, we launched Enterprise 6.0 that makes analytics faster and easier for business users. We added DB Connect to deliver real-time integration between structured data from relational databases and Splunk. We added SmartCloud, Hunk, and VMware premium app, more SDKs for developers, mobile with BugSense, network with Cloudmeter. All in the spirit of Splunk everywhere or anywhere you have your data. Our product investments are all about making the adoption of Splunk easier for our customers, allowing them to gain valuable insights from their machine data, irrespective of their environment, data sources or where their data lives.

On the field side, we built our capacity globally. We grew our quota carriers from 163 to 220 over the year. And of the 220, approximately 60% were tenured 12 months or more as of January 31. Overall, we grew our head count by over 300, and ended the year with more than 1,000 total employees.

As pleased as I am with that progress, we're still in the early stages of this phase of innovation in the market. We have a unique opportunity to establish Splunk as a standard for our customers, and we will continue our focused investment in product and the field to accelerate adoption. I'm going to talk more about that in a minute.

Splunk continues to deliver incremental value to our customers, and as they ingest more data in their enterprise. In Q4, once again, more than 70% of our license bookings came from existing customers, while we added a record 500-plus new customers.

For the full year, we added about 1,800 new customers overall, and ended with over 7,000 in total. In Q4, we recorded 289 large orders, which we define as those greater than $100,000. This compares to 171 in Q4 last year. On a full-year basis we booked 791 large orders compared to 467 last year. While we did not have a $20 million order like last year, we did record 21 orders greater than $1 million in Q4 alone. This compares to 11 in Q4 of last year. For the full year, we had 41 greater than $1 million orders, compared to 25 last year. Increased awareness and adoption of Splunk software are driving this significant large order momentum.

Enterprise adoption agreements, or EAAs have become an effective structure to enable customers to standardize on Splunk. Many of our large orders in Q4 were EAAs which as I've said, are typically deferred up front and revenue recognized ratably over time. A mix between term and perpetual bookings impacts how bookings flow through the balance sheet and the income statement as you know.

The total of all of these [rival] transactions accounted for 43% of our quarterly license bookings in Q4. Obviously this is significantly above the 20% to 30% band we estimate in any quarter. As customers continue to adopt, we expect the variability in timing and size of these types of transactions will continue going forward.

From a geographic perspective, I'm pleased with our execution. In Q4, international operations represented approximately 25% of total revenue. APAC and EMEA both posted their best quarters ever, each growing total bookings by more than 70% year over year. Transactions involving our channel partners accounted for 41% of license bookings in the quarter, reflecting our growing partner ecosystem.

Our maintenance renewal rate was 94% for the quarter, up from 92% a year ago, reflecting the value our customers derive from our products as well as our field coverage and capacity expansion in terms of customer reach. As a reminder, we calculate our maintenance renewal rate on a rolling 12-month basis.

Our education and professional services represented 5% of revenue in Q4, in the range of past levels of 5% to 10%. Now remember, we recognize revenue on services when they're delivered. Therefore services bookings typically do not flow through the balance sheet as deferred revenue.

Turning to margins. The detail I give for operating metrics are non-GAAP, and exclude non-cash stock based compensation and payroll related to employee stock plans, impairment of long lived asset, amortization of acquired intangible assets and acquisition related items.

Our overall gross margin was 92% in Q4, in line with prior quarters. Gross margin on services which includes support, maintenance and professional services was about 75%. Q4 non-GAAP operating income was approximately $4 million, representing the positive margin of about 4%. Our overall op margin was lower than we had expected due specifically to the field's significant over achievement in Q4 and for the full year. Still, operating margin for the full year was consistent with our break-even expectation as a negative 0.4%.

Given our Q4 non-GAAP net income position of $3.4 million, EPS of $0.03 per share was based on a fully diluted weighted average share count of 118.7 million shares. Our full year non-GAAP net loss was $3.1 million, or a $0.03 loss per share, based on a weighted average share count of 105 million shares. Cash flow from operations in Q4 was $34.4 million. Free cash flow was $32.4 million and we ended the quarter with almost $900 million in cash, which reflects the $538 million of proceeds from our follow-on offering in January. Full-year cash flow from operations was about $74 million or 24% of total revenues.

Looking back over the year, our product and field investments are paying off and I'm very pleased with these results. Now looking forward, we're going to continue investing in these areas, likely at an accelerating pace as we scale the business for our next phase of growth. Crossing the 1,000 employee mark provides us the critical mass needed to add overall capacity faster. In absolute numbers, we will add more field capacity in fiscal 2015 than we did in fiscal 2014. Because our customers are utilizing Splunk in a broad and growing set of use cases, we're also planning on adding sales resources which will be aligned with our core markets, as we enhance our overall field capabilities.

Our plan is to invest proportionately with our top line growth, so for the full year fiscal 2015 we are targeting roughly non-GAAP breakeven operating margins. We remain committed to running the business on a positive operating cash flow basis, and estimate full-year operating cash flow will be approximately 20% of total revenues. We will achieve these operating results on our expected full-year revenue of about $400 million. We expect Q1 revenue to be between $78 million and $80 million, with subsequent quarterly revenues following the seasonal patterns we have seen historically. License revenue will likely account for about 60% of total revenue in Q1, growing to two-thirds by Q4.

With the continued investments that I've described and overlaid with our revenue plan, we expect negative non-GAAP operating margin of 8% to 10% in Q1, accreting gradually in quarters 2 and 3 then turning positive in Q4. Consistent with the seasonal nature of our model.

Overall, I'm very pleased with our Q4 results and our full-year performance. Our product investments are driving customer success, and our field expansion is enhancing our execution capabilities. Our strategy is working well, and we will continue to invest and fuel the pace of adoption as we aim to make Splunk the standard for machine data analytics.

Thanks much for your time and interest. With that, we will open it up for questions.

(Operator Instructions)

Our first question comes from Brent Thill with UBS. Your line is open.

Good afternoon. Godfrey, you mentioned the change on the pricing of the low end. I'm curious if you could just update us on the pricing at the high end if you made any changes? And I'm just curious just as a follow-up for Dave, I can ask him in a minute.

Yes. We haven't made a formal change to the pricing list or anything like that on the high end. But of course we tend to engage with customers on enterprise adoption agreements which are generally custom agreements. So that's generally how we handle that.

Okay. So no changes behind relative to what you announced the lower end on the entry level?

Yes, the only pricing change announced was what we saw at the entry level. And that's basically the price points are about the same so we doubled the data volume. So hopefully customers have an opportunity to experiment more, do more and the like. In some ways it kind of pattern matches what we did on the high end, where a lot of times we give customers extra capacity so they can do PSDs at will or experiment with new data sources and use cases. So the intent was the same which was to give customers more flexibility to do more things with more data.

Okay. Great. And Dave, just a follow-up. A lot of questions around the sales force capacity. The year before you were growing at a faster rate and you took a little bit of a pause.

Not that the growth rate was a big pause. When you look at this re-acceleration from a productivity standpoint, can you help us understand the tenure, what's giving you the confidence now to bring the growth rate back up? Maybe a little more color on that would be helpful.

Thank you.

Sure, Brent. Thanks for the questions.

As we discussed, I think pretty consistently and I mentioned in the prepared remarks around having enough critical mass to actually get folks into the Company. As we're looking forward as we've crested 1,000 folks, and we've got the capacity in the field, we see the opportunity to match our field capacity with the demand that we're seeing in the markets. So the markets themselves are maturing.

The customer demand is there. We have the resources to bring people on board. So that's the basis that we're looking at, saying, okay, we're in a good position to grow the field capacity in absolute numbers more than we did in fiscal 2014.

Thank you.

Our next question is from Phil Winslow with Credit Suisse. Your line is open.

I have a question on the enterprise adoption agreements that you mentioned. This has been a focus for you all this year. Wonder if you could give us more color of just the feedback that you're getting now that you've been doing it for a while from customers in terms of real volume, plus pricing and how those are sort of trending in these negotiations?

Just a couple of comments on that. Customers have a few what I would call favorite flavors that they like to approach on enterprise adoption agreement. Sometimes they want to just buy X amount per year on a term basis but be able to know that here is -- that we negotiate a pricing level and a capacity level, so that they know how much it costs for them to expand over a series of years. Kind of a straight term but with a predictable forward-year pricing model. We have seen some of that. Some customers really like to do it that way.

Other customers like to buy a certain amount of perpetual capacity, but they want to know what the price is to buy more, and so we negotiate out and give them quantity discounts for bigger data volumes, and they either sign single or multi year agreements around that. Others are ones where we give them a fixed capacity rate, but we give them the ability to burst above that for a period of time. So there are multiple ways that customers like to do these. They are not all of the same, but there are three or four flavors that you see most frequently.

The important point as Dave mentioned, in Q4 alone, 43% of our bookings were customers who were buying in some way a rateable type term or similar contract, because they wanted a multi-year look to their capacity model, and they wanted room to grow. I think it says a lot about how customers are really reacting positively and engaging with us to say, make it easier for us to put more data into Splunk and get more use cases built.

Got it. And also given the timeline of the RSA conference. It was great to see this. The continued growth and the traffic at your booth. Maybe you could elaborate on what you got out of RSA this week, and the feedback and then also maybe a little more granularity on the to go-to-market strategy there that you mentioned?

I'll tell you the first thing that I noticed at RSA this year, the word SIM is nowhere to be seen. Do you remember a couple years ago where we started the sort of thing -- we weren't tracking SIMs but we were basically pointing out that it's not about static rules engines on top of databases, it's always about security analytics, it's about the unknown threat. It's about APTs, it's about being able to do analytics on large volumes of data.

It was funny this year to walk around and look at all the signs in everybody's booth. Security analytics, security intelligence. Security whatever, big data. The word SIM was nowhere to be found anywhere in that show.

So I think the market this year is coming along where there's -- there's pretty concurrent views now that the old-fashioned way to do things, like a SIM, is pretty much dead, and everybody is going to malware and analytics. You name it, it was all about big data analytics. I think we're in pretty good shape there to continue to drive that agenda.

I think we're sort of emerging as the -- I won't want to say the thought leader. But certainly the technology approach that is more -- that is more appropriate for today's environment of APTs and all of that. So that was really to me the biggest -- the biggest change between any prior year of RSA and this year. You couldn't find the word SIM anywhere.

In terms of the organizational structure, you know, I had a chance to do a walk-around yesterday with Haiyan yesterday and she is just awesome. And her insight into what is going on in that market is just fantastic. And of course she knows every customer, and every partner, and every other vendor pretty well. And I think that she is just a great example of the kind of talent we need here.

That she is so experienced in the security market, that she will be very effective in helping us create a strategy, a business plan, a dedicated set of resources across the Company that really, really knows security deeply, and much better customer results. We had a large customer dinner last night, and a lot of them had a chance to meet and interact with Haiyan.

And they were all coming up to me at the end of it and saying this is a great move and she is a great talent and you are right on track. I'm very encouraged about this market group approach to helping us expand.

Great. Thanks, guys. Congratulations again.

Our next question is from Keith Weiss with Morgan Stanley. Your line is open.

I have a question for Dave. Just in terms of the guidance looking into 2014. While the pricing change makes a ton of sense longer term and the Landon expansion strategy has more than fully proved itself out, have you implied or have you put in any measure of conservatism in the guide for potential near-term impacts from that pricing change?

No, not specifically, Keith. We look at our overall capacity in terms of field coverage and combine it with real-time pipeline analytics to come up with our estimates around revenue. I think the pricing change, as you astutely point out, is really about enabling adoption. And we expect as more customers put more data into Splunk they are of course going to become larger customers for us. The things that we do look at, as you would well imagine, is mix.

How much of our revenue is going to be of the perpetual nature versus the ratable nature. And if you look at the composition of Q4, we obviously were very pleased with our overall revenue results, and you look at the change in deferred revenue you can see the 43% of license bookings significantly ahead of our 20% to 30% estimate, being reflected on the balance sheet. So when we look forward and we talk some about the early success we're seeing around Hunk, which is also a term type product, we contemplate those factors into the pipeline and ultimately what we provide is our revenue outlook.

That was actually going to be my follow-on question. Given the success that you've been having with some of these ratable contracts, what should we be assuming for FY15 in terms of that range? Are we sticking with the 20% to 30%?

Last year, mid year I actually increased that to 20% to 30% when it had previously been 10% to 20%.

Right.

As you know many of our largest transactions occur in the last half of the year. The larger ones will most likely have the adoption elements that make them ratable, again evidenced by the 43% in the fourth quarter. I think what we need to do is get another couple quarters under our belt in terms of what is the actual experience and trend line on an annual basis and at that time, I'll update that guidance if it needs to be updated. Today I'm still sticking with 20% to 30%.

Got it. If I could sneak one last in for Godfrey.

You mentioned earlier in the call that you are now in two-thirds of the Fortune 100. So obviously you are seeing good success with large enterprises. What exactly does it mean when you talk about becoming more of an enterprise Company?

It really means more about our ability to expand from a departmental, you know, win or solution of some kind, to becoming an enterprise standard for how they manage their machine data and all of the analytics that come with it. If you look across our large customers, we may be in two-thirds of the Fortune 100. But in most cases we enter in in a single use case and we are there for a while and then we work our way across departments and all that.

Where I want to be is just like where we are with Intuit, where they have basically announced that they have standardized on us for all machine data analytics and they are using us everywhere throughout the Company. That's our opportunity with every customer is for them to use us all across the board. Not just in one department or two departments.

When I think about us becoming an enterprise vendor and successful at the enterprise scale, it's really about us being as ubiquitous in every one of our customers as an operating system is or as a data base or as an enterprise data warehouse, where they're using us for as many use cases as we can give them value.

So I just think we have such a long way to go there. I'll be on this enterprise kick for a few more years.

Outstanding. Keep up the good work, guys.

Our next line is from John DiFucci with JPMorgan. Your line is open.

Thank you.

I have a question for Godfrey and then a follow-up for Dave. Godfrey, could you talk a bit more about the rational about the doubling of the liscensed capacity for entry to the customers. It seems preemptive on your side to see the market more. But was the decision influenced by competitors or was it more by customers or both?

Just by our experience with our own customers. So we are in pretty close contact with our customers, large and small. We have an inside sales team down in Plano that talks to hundreds of customers a day. We know what is going on in that marketplace. The thing that I observed, I go down there a lot, the thing that I observed from talking with a lot of our is that some of our customers get stuck.

They buy a small license and then they stay there for a while because they bought just enough to get the job done, and then they don't have enough capacity to put more data sources in and try some things so they get stuck. That's not where we want them. We want our customers to have enough capacity so they can do the job they're trying to do and also have the ability to flex up and put some more data forces in and try some new use cases and all of that.

I can tell you as a closet marketing guy, I want to see customers have the opportunity to really create some of their own new use cases and not just get stuck with the fact that they're at a volume limit and didn't have budget or whatever else.

So, you know, look at all of the innovative use case that come from our customer base, and it's in our best interest and theirs for us to give them more capacity than they initially need, so that they can grow and expand and experiment. So, I couldn't be happier about it.

Okay. Great. So it's customer driven. And, Dave, I just wanted to make sure that I'm thinking about this right. You guys put up really strong top line. But EPS was a little bit below what we and I guess the street was looking for.

Not a lot but just a bit. You also said that you had more license bookings that were deferred and deferred revenue validates that. It's really strong. So I guess I just want to make sure. So I'm thinking more deferred revenue, less recognized right up front, which would actually flow down to the bottom line. And then I guess if there's going to be -- you're not saying there is going to be.

But if there is going to be more term going forward, we would see a net negative effect on margin, on the income statement, all else equal. But what effect would that have on cash flow, if any?

Thanks, John.

You're thinking about the geographical differences between balance sheet and income statement correctly. If we had, say, 30% of our licensed bookings be ratable versus 43%, then deferred revenue would be less and revenue would be a lot more. And all of that affects margin, as you point out. At the same time, it has no effect on cash flow.

Okay.

So -- and you can see that in our results. 24% of revenue is positive operating cash flow. And we expect to continue to generate significant positive operating cash flows going forward, regardless of the geographical location of the bookings at the end of the day.

It's one of those good news problems. We had a blowout quarter from a bookings perspective, and 43% of it shows up as ratable. You have to pay commissions on it. You have selling expenses associated with it, and it's millions of dollars worth of extra commissions payments to the field organizations for outstanding performance. I'll pay for that all day long.

It's just that if it's ratable in this quarter, it's going to cause us to be a little -- we have a little bit of exposure on the expense line. There you go, it's a nice problem to have. I'll take it all day long.

Yes. In fact, it's -- we're paying commissions for what is on the balance sheet.

There's a lot of companies that capitalize on that. We don't capitalize it. Exactly. We're paying commissions for what is in the balance sheet. It's not a bad thing.

No. No. That's actually very clear. And I just wanted to make sure I was thinking about it correctly and I am. Nice job, guys.

And our next question is from Peter Goldmacher with Cowen. Your line is open.

Thanks. Godfrey, can you talk a little bit more about what you're doing with the sales force? Conte says you guys are ramping up your spend so you're going to bring more guys on board. It sounds like there's some sort of segmentation happening, but it wasn't clear to me what the segmenting is going to look like. Can you help me understand that, please?

Yes, good question, Peter. And I didn't really address it in detail. We have to have a certain amount of just geographic and territory coverage. So at the account manager level, I anticipate for a while that those folks will sell everything and they will be, you know, masters of the universe but not specialists at something.

In each geography, we have to start layering in more people who are highly specialized and knowledgeable about, in this case, the security market, that happens at the SE level. It happens at the -- at the professional services level. It happens in technical support. It happens in product marketing and management and the like.

So you have to think about against a generic org chart, there's some amount of green people out there to go along with all of the rest of the vanilla people. And as segments grow, we will put some red people out there and some yellow. You have to be able to blend in some and you can call it a overlay, but we have to have some additional security specialization all over the globe in each of the sales areas, whether it's presale, sales, PS, support, training, you name it, because it's a very specialized market. You either have the secret handshake and you are the main knowledgeable or you're not.

And one of the reasons why we've been so successful in the security market to date is because, A, we have great technology. And B, we have a lot of really smart security people sprinkled throughout the global organization. What this market group does is put an overall framework on top of that, so you have a really sharp domain leader at the VP level, and you build a, I don't want to call it virtual because it's not virtual. It's very hard. You build a very clear team throughout the world that can help attack that market opportunity. And their job is to go help the geographic field organization, the geographic field organization succeed in those types of opportunities.

So -- so I'm still not totally sure I understand. Security has been one of your primary use cases since you started the Company. So are you saying you're putting quota carrying reps only responsible for security, or you still have sort of an account quarterback who can call in a security specialist?

It's the account quarterback that can call on a security specialist. I wouldn't be surprised if we put some people in the field who carry quota just for security at some geographic level. But certainly not down at the account manager level.

So -- but you have been organized this way forever. So what is different now?

Well --

You have a security BU head?

Yes. But if you looked inside of our org chart, that would have been a pretty thin structure. I would hate to tell you how few people in the world had security on their badge. So this is a big boost in the investment in that market.

Okay. So let me ask you a longer term question. So you guys have been around for, I mean, it's almost a decade and you're just now getting to specialists for a market that has been your bread and butter for -- since almost day one. So how should we think about as you branch out into these use cases, you talk about electric sensors on Volkswagen electric vehicles and sensors data from hazmat sites. Can we expect to see any sort of vertical go-to-market in those use cases, or how do you think about building out expertise in these -- in the use cases that are not 10 years old?

Well, you hit right on the -- on the point of how I look at this, which is I need to be able to have teams that are so good at the core segments that it gives me more time and some of the staff more time to go look at some of these new opportunities. So I look at forming up with a VP and a VP and a market booth and dedicated resources, from product marketing, product management, development, all the way through the field organization around security as a model for how we would get other segments aligned.

Once you have those, they run much more effectively than all of us trying to think about 10% this day and 10% that day. You have dedicated 24 by 7 focused around those segments and it enables me and some of the rest of the team to go look at the new segments, to go look at some of the new market opportunities knowing that we have a machine that runs the core segments. So I view it as -- as helping free up the Company to examine some of these new markets like business analytics, Internet of Things and the like. It's a necessary move.

Peter --.

I'm sorry. Let me ask one last philosophical question. So what -- when you think about a market developing, how aggressive do you want to be in helping that market develop, and getting involved really early, and getting evangelical use cases versus letting the market develop a little bit in a little bit more form, and then getting involved? What -- what part of the market development life cycle do you feel like you really want to start putting specific domain knowledge in the market?

If it's big enough and it's consistent enough -- I beg your pardon?

What is big enough, I guess, is the shorter question?

Well, I don't know, maybe -- maybe we can take that offline and have a more -- a deeper conversation about it. But it's -- you wouldn't form a market group around something that is so early you don't know what it is. It has to be mature enough where it has a repeatable motion so that you can put a lot of resources against it and make it hum. I think the short answer is, emerging markets you go find out and experiment and be agile and just keep learning. And once you sort of know what it is and it's more defined, you can put more defined resources against it.

Okay. Thanks a lot, Godfrey.

Our next question is from Heather Bellini with Goldman Sachs. Your line is open.

Thank you. In response to the past few questions on sales, I guess I'm wondering, do you also need to see changes in terms of how the sales force is structured in order to get that solution sale that you were referencing to keep before? It seems as if you're talking about specialist sales, but it also seems as if you're looking to start out initially with a broader footprint at the time of initial sales with a broader product footprint.

I'm just wondering how do you marry that strategy, and also how important is the SI community in helping you to drive that? Thank you.

I lost the last couple of words. How important was the what?

The SI community.

Oh, okay. Thank you.

Here is how I think about this. If you look at where we are in any given country, when we first go in, we're -- if we only have a few people in a geography, our -- our customer wins there are lopsided. They look like the resume of whoever came in.

If they came out of a VMC or an Oracle, somewhere, you will see a lot of IT operations, but they don't know enough about security or have the domain expertise or confidence to go sell it. If they came out of a security background, they probably go do that and they're comfortable with it. Until you get critical mass in a geography, oftentimes our segment mix looks overweighted to the -- to the experience level of the few people that you have there. So you have to -- you have to fill it out as you put additional critical mass in country in order to get there. So part of your question is, how do I think about the field organization.

It depends on how far you are from the flagpole. In the US it's easier to have one answer because you have enough critical mass of people that you can start to deal with things like specialization. Where when you get outside of the US we're often still dealing with just critical mass issues. So this whole segment approach is a way to get specialization, to get help into -- into geographies without having to hire a sales force for every solution area. I think that's way too expensive for us to do.

So we have a generalized geographic reach, and then we put specialists in who can help them all go be better at a given opportunity. So one of the earlier questions was how do I think about enterprise.

To penetrate a customer and do the very best job we can for them, we can't just go in and be successful in IT operations and then call it success. We need to go penetrate the security department. Well, we better have some security smart people to do that because it's hard to do.

The competition that you're up against is highly specialized so you better have the same -- the same mojo working for you. It's kind of a mix between what -- how far is it from the US, how many people do we have in the country, what's their backgrounds, and then how do we start to overlay some of the domain expertise.

Now your question about SIs, I think the SIs are helpful when a customer reaches pretty large scale. A customer has to want to buy a significant amount of SI help. You know, they book people and they book them in quantities and over time.

And Splunk at the departmental level is not a very good match for that, because it goes in so easily and quickly there's not as big of an opportunity for them to install their services. It's when you go up in the seven figure orders and the like where there's a big enough footprint and a big enough project underway for the SIs to match up. I think part of the reason why we're just now coming on with SIs is because Splunk heretofore, the installations have gone in so quickly that there just simply wasn't much of an opportunity for them. As we get some of these larger, big scale enterprise customer opportunities, the match for them is better.

Heather, this is Dave. One other comment just in terms of the composition of the field organization. One of our challenges that has been the result of the opportunity with 100 quota carriers growing to 160, growing to 220, with such breath of use cases we have had what I would consider to be an unusually long time to productivity for our field folks.

You know, a year is a long time for a trained seasoned enterprise salesperson. And the reason -- trust me I have spent a lot of time looking at productivity, is there are so many use cases in so many different markets that it's really challenging for those people. Now that we have gotten to a certain level of scale, adding in a layer of what we're calling the market specialists, that can really dig deep we think is an important enabler to getting broad adoption in our customers.

Thank you very much, guys.

Our next question is from Aaron Schwartz with Jefferies. Your line is open.

Thank you. Just a follow-up on the EAAs, Dave. I know you mentioned seasonality seemed to be a big part of this and you're maintaining that 20% to 30% outlook here. Given that dynamic here in the quarter, any words of wisdom on the seasonality for deferred going into next year?

Yes. Deferred is -- is certainly an interesting one. You know, a year ago, we had a $20 million transaction that came in right at the end of the quarter, which is reflected and deferred. And a lot of folks built that into their models. I think if you just think about the seasonal nature of how our bookings are going to come in, like we're not going to guide to deferred.

But you should certainly look at our historic trends around the mix of revenue and -- and deferred together, in terms of first half, second half. We expect this year will follow that seasonality. That's probably the best way to look at it when you're updating your own model.

Okay. And second one, if I could, quickly on the business unit structure you mentioned. If I just take a step back from the operational aspect of it. Given sort of a business edge here at least in security and maybe extending to other areas over time, how does that change the strategy for that unit, and is there any more independence within those units to do acquisitions, at least in security? Are there any other sort of technologies that you would look at given you're in this structure that you may need to add going forward? Thanks.

I like the second half of your question, which is when you think about the domain experts or the VPs running these markets as having an acquisition appetite. I would fully expect that the type of technology acquisitions that we might want to do, for example, in the security area, would be very different. Could be very different than the ones that we might want to do in the business analytics area or Internet of Things.

And part of the benefit you get out of folks who worry about that 24 by 7, is we all know what combination of things they need to put together a whole product offering for those customers and will either build it or buy it. But I think it will have an impact on our partner ecosystem, on our technology road map. On the way our organization is structured, our alliances, our competitive capabilities and everything about it I expect will get better because we have focused resources around that.

Aaron, just to clarify. I don't want folks to take what we have said too literally. We are not creating dedicated business units with general managers running those in the products today. We are still functionally organized, we are adding industry specific specialization into the group to, again, help us serve our customers across these broad set of use cases. Don't expect us to start talking about results by business unit.

We do talk about where we are strong in the segments and where we're headed. But I don't want folks to think that we're creating these structures in terms of dedicated stand-alone business units.

In fact I think the in between ground between purely functional and a BU, is effectively a market group because you have underneath that a functional structure.

Exactly.

Fair enough. Thank you.

We have time for one more question which will come from Brendan Barnicle with Pacific Crest. Your line is open.

Great, guys. Thanks so much. I wanted to follow up a little bit on Heather's earlier question, and really go back to the direct versions and indirect breakdown. If you could remind us what the breakdown is between direct sales and indirect sales?

In the quarter, 41% of our licensed bookings came from or were associated with a partner.

And then as you think about some of the changes that you talked about on the call today, any expectation that, that would change in any material way over the near term?

If anything it's likely it has over the last couple of years continued to move gradually upward as we get more and more partners involved in our business. I would say that it's likely to continue to move upward.

As you would expect, Brendan, it's regional where in APAC a vast majority of the business is associated with a partner. Less so in Europe. Heavily weighted in the public sector. And then not so much in the Americas proper.

So there's also a certain seasonal element to it because as we know public sectors have seasonal rotations as does Europe. So annually, to Godfrey's point, we expect it will creep up. But it's going to bounce at these absolute levels based on each one of our regions, and how they're performing.

Great. And then just one overarching question on sales. Have you seen any change in attrition rates as you have built up and have some of your folks have been there for a longer period of time now?

It's still pretty low. And that's something that we strive to achieve. So the whole notion of being very careful about who you hire, making sure that you give them the right kind of training, and enablement, and ramp activities, and the right level of support is all designed around having a much wider velcro of success. Part of that success model is that when people are making quota and successful if their territories, you have less turnover. So the impact of lower turnover is just critical in software.

If you have -- if you're hiring 30% or 40% more capacity every year, but you have a 20% turnover underneath it, you've got 50% -- you're hiring half of your sales force every year. So you never actually get productivity nor do you get them to a level where they're totally ramped and knowledgeable. So to us, low turnover at our growth rate is actually a critical success factor to being able to do what we do.

It's such a great question because, you know, we get a lot of questions -- I get a lot of questions around why don't you hire faster. We think we have the ability to do that this year. But we certainly could have always hired more people sooner. But getting them on board and productive is reflected in the low attrition rates. If we had really jacked up the hiring, I believe we would have seen a significant uptake in attrition, just because our capacity to onboard then and get them productive would have been so constrained.

Great. Terrific. Thanks, guys.

Okay. Bridget. I didn't hear your cue. That concludes the call this afternoon. Thanks very much for joining us. We are around tonight. If you have any questions, by all means reach out and we look forward to updating you next quarter.

Thanks, everybody.

Thank you for participating in today's conference. This does conclude the program. You may all disconnect. Everyone have a great day.