Splunk Inc (SPLK) 2015 Q3 法說會逐字稿

Good day, ladies and gentlemen. Thank you for standing by. And, welcome to the Splunk Incorporated third-quarter 2015 financial results conference call. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session, and instructions will follow at that time.

(Operator Instructions)

As a reminder, this conference call is being recorded. I would now like to turn the conference to our host, Mr. Ken Tinsley, Splunk's Corporate Treasurer and Director of Investor Relations. Sir, you may begin.

Great. Thank you, Eric. Appreciate that, and good afternoon, everyone. With me on the call today are Splunk's CEO, Godfrey Sullivan, and CFO, Dave Conte. Our press release was issued after close of market today and is posted on our website. This conference call is being broadcast live via Webcast, and following the call, an audio replay will be available also on our website.

On this call, we will be making forward-looking statements including financial guidance and expectations for our fourth quarter and FY15 and FY16 years, transaction and product mix, uses of our software, planned product sales and facilities investments, increasing customer adoption in our product and apps, market and use case opportunities. These statements reflect our best judgment based on factors currently known to us, and actual events or results may differ materially.

Please refer to documents we file with the SEC including the Form 8-K with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures which are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of GAAP and non-GAAP results is included in the press release and is available on our website. With that, let me turn it over to Godfrey.

Thanks, Ken. Greetings, everyone. Welcome to the call. Another fun quarter in Q3, and as always, big thanks to our customers and partners for their passion and their support. Revenues were $116 million, up 48% year to year. License revenues, $71.8 million, up 41%. Notable customers included AT&T, SAP, Shazam in the UK, and Weight Watchers. Themes for this call: Cloud, public sector, product momentum, and markets.

First, I want to thank many of you who joined us at this year's user conference. We welcomed more than 3,000 attendees, and 80 presentations from passionate Splunk customers, covering a wide range of very cool use cases. During the keynotes, execs from GE Capital, Coca-Cola North America, NASDAQ, and Red Hat described how Splunk powers their future. Coke is using Splunk to push data-driven decision-making across their business and to break down data cartels.

Splunk, embedded in their Cloud architecture and even mining data from their Freestyle machines. GE Capital's CIO spoke about how Splunk is central to their continuous app delivery process. For GE, we enable RAP [app and] development, help deliver competitive advantage to their BUs.

The CIO of Red Hat described their migration of apps to the cloud and how Splunk is their service assurance platform. And, the CISO of NASDAQ talked about Splunk as part of their next-generation security intelligence platform. These are just some examples of the amazing customer stories that come out at Conf. If you ever need a shot of adrenaline, just spend some time with our customers.

Let's go to Cloud where the word of the day is velocity. Our largest transaction in Q3 was for Splunk Cloud. A seven-figure order with a leading sporting goods Company. They selected us as their next-generation security intelligence platform, replacing a legacy SIM. This customer already uses Splunk on prem and wanted us to manage this new project as a service.

Orrstown Bank, an East Coast community bank, is a new Splunk Cloud customer. Our champion there brought us in after having used Splunk for years at JPMorgan, and we went from POC to production in one week. Intermedia, a one-stop shop for Cloud business applications, selected Splunk Cloud for our rich feature set, high security, and the ability to scale to match their growth. And, from the education market, Chicago Public Schools selected Splunk Cloud for IT ops.

Our Online Sandbox is doing great with thousands of free users, and it's a natural complement to our premium download model. Best news of all, I can tell you as former acting GM of our Cloud business, I'm delighted to have replaced myself and to welcome Marc Oleson to the team. Marc ran the Cloud businesses at McAfee and Mercury. He fits right into the Splunk culture and has hit the ground running.

Just in time, too, as we had a big presence at the AWS show last week where we announced Hunk on EMR and our new app for AWS integrated with Cloud Trail. Customers are moving production apps to the Cloud and Splunk is a big part of moving to the Cloud with confidence. To summarize, a great quarter for Cloud. Our largest customer order, doubling our customer base, and strong market momentum with Amazon.

Now, on to public sector where our team delivered another record quarter. You would expect strength given that it's fiscal year-end for federal, but our performance was broad-based, federal, state, and local. I'm happy to report that we signed an enterprise agreement with the Department of Energy who have more than 75 sites using Splunk, and we are now the standard for operational intelligence at the agency.

We also signed an enterprise agreement with the US Postal Service who purchased a 10-terabyte license for security analytics. They also plan to analyze the data coming off their postal machines. Department of Homeland Security bought a multi-terabyte license to replace a legacy SIM which is becoming a recurring theme in our security practice. Public sector is a market that's highly dependent on word of mouth and where interagency references matter. Our public sector team is delivering customer success that's becoming highly visible in the beltway, and Federal Computer Week just named us the hot Company to watch.

On to the product update. We shipped Splunk Enterprise 6.2, Hunk 6.2, and Splunk MINT Express. Enterprise 6.2 delivers easier data on-boarding, pattern detection, and lower TCO through improved hardware performance and easier data management. Hunk 6.2 is now integrated with the Amazon Elastic MapReduce console. It's easy for customers to analyze data in EMR and S3 and priced by the hour like the rest of that stack. Hunk wins include Comcast, Vodafone Germany, and the DOE.

One of the ways that we're expanding our addressable market is by taking in more data from more sources than ever before including mobile, wire, mainframe, and sensor. MINT Express gives mobile application developers real-time analytics on app quality, usage, and performance. Our app for Stream makes it easy to capture and analyze wire data. Our partner Syncsort released their iron stream app for customers who want to analyze their mainframe data. And, our partner Kepware launched the industrial data forwarder to send SCADA, sensor, and control system data into Splunk. Use cases include operational improvements, preventative maintenance, and security. Very strong customer interest at Conf for all of these products.

Let's go to market segments. Earlier this year, we told you about our move from a purely functional org structure to one that includes market segment teams. Security was our first segment for this structure and Haiyan Song is doing a brilliant job leading this group.

It's prime time for Splunk in security. No one wants to be the next breach headline, and Splunk is a critical part of the equation evidenced by our enterprise security app, which had a record quarter with more than 200 orders. Con Edison is a new Splunk customer and selected us to replace a legacy SIM. Beth Israel Medical Center, a teaching hospital for Harvard Medical School, is another new security customer. UniCredit, in Italy, is also a new customer, and we're helping them comply with local banking regulations, security, auditing, and compliance reporting.

Now, on to the ITOA market. As we did with security, we're now extending the same market group org structure to our application and IT ops market. I'm delighted to tell you that Rick Fitz has joined Splunk as the exec to lead this market group. Rick is well-known in this marketplace, having been SVP of product management for CA's service assurance products as well as similar experience at Network General and BMC.

Customers selecting and expanding their use of Splunk for operational use cases included ADP, Abacus International, and Zulily. One of our new customers in Q3 for IT ops is Oscar Health, where the support teams now have real-time dashboards on metrics such as resolve issues by agent, top issues resulting in tickets, and unresolved ticket status.

One more fun customer story. This one in business analytics. I hope you've had a chance to see a Niners game in the new Levi's stadium. As a season ticket holder, I can tell you that one of the really cool things is the Levi's stadium mobile app. Splunk is helping bring to life the business benefits of this app, which was created by the VenueNext team, and their goal is to elevate every aspect of a fan's experience on game day.

Splunk is powering the real-time data and analytics dashboards on game day. So, thanks to the data feeds, the venue operator knows what food and drinks are being ordered, parking lot availability, wait lines at concession stands, network performance, and even how many fans are entering the stadium using mobile tickets. Customers like this are what makes Splunk so much fun.

There are common threads across our business analytics customers. The most common use cases are customer experience, product analytics, digital marketing, and business process analysis. They use Splunk to mash up unstructured machine data with structured business data. For example, matching customer IDs in the logs with the customer profile in their CRM system. And, as a result, they get real-time analytical trending without the need for ETL or the latency issues involved in data warehouse reporting.

Let's switch gears and go for a moment to higher ed. You may recall in Q1, we announced a partnership with Internet2. This agreement enables member universities to buy Splunk with a pre-negotiated contract and subscription pricing. In Q3, we signed our largest I2 order to date, a 1-terabyte order from the University of Illinois. Even as a Baylor Bear, I'm glad to welcome the Fighting Illini to Splunk.

At the academic level, more than 100 universities have now made Splunk part of their instruction or their research programs, most recently, Georgetown, Northwestern, and the University of Oxford. I'm very excited to see the progress we're making in education.

Before closing, I want to take this opportunity to welcome Mark Carges to the Splunk Board of Directors. Mark formerly served as the CTO of eBay and also former as GM of products at Weblogic, and I'm thrilled to have Mark joining our Board.

Thanks again to our customers and partners for another really fun quarter. Our success is merely a reflection of their success and their enthusiastic support. And, I also want to thank many of our investors who are taking the time to attend our events, meet our customers, and learn more about our business. Thanks again. Over to Dave.

Thanks, Godfrey. Good afternoon, everyone. Thanks for joining the call. As you can tell by the press release, Q3 was a solid quarter, led by strong delivery from our field organization, and our public sector team in particular. Third-quarter revenues were $116 million, a 48% increase over Q3 of last year. License revenues grew 41% over Q3 last year, totaling $71.8 million.

Once again, in Q3 more than 70% of our license bookings came from existing customers in the form of upgrades and expansions. We continued to see about two-thirds of our upsells coming from horizontal expansions into new use cases within the enterprise. We added over 500 new customers, recorded 290 orders greater than $100,000, and again, closed with more transactions than in any other prior quarter. Just to clarify, the users trying Splunk in our Cloud Sandbox environment are not included in our total customer count and have not contributed to revenue.

Just as we've anticipated, the mix of ratable transactions continues to vary substantially quarter to quarter, generally following seasonal trends and driven by customer buying behavior, adoption transactions, and the consumption of products that are recognized ratably, such as Hunk and Cloud. The mix in Q3 was approximately 40%, including the contribution from these types of transactions. Of course, this was significantly impacted by the seven-figure Cloud transaction that Godfrey described earlier. Excluding that order, the Q3 mix would have been 34% ratable. Given that Q4 is traditionally our highest volume and highest velocity bookings quarter, we expect the full-year mix will likely be closer to the high end of our 25% to 35% range.

As we continue to gather more data points on drivers affecting mix, we'll share them with you and revise our expectation for mix in future periods accordingly. In particular, the early indicators of success from our Cloud offering, which is of course traditional SaaS and therefore ratable, suggests that long-term mix could go even higher. It's possible that the contribution from our Cloud business could represent 25% of the total in the medium term. Obviously, this will be a significant driving force behind the construct of our revenue and cost model going forward.

In Q3, international operations represented approximately 21% of total revenues, in line on a year-over-year basis. We'll continue to make investments in our international business and look forward to continued growth and expansion of Splunk globally. Related to this expansion, we ended the quarter with 280 quota carriers and were on track to end the year in the range of 300 to 310 in total.

Recall at our analyst meeting last month, I mentioned the evolution of our go-to-market strategy and aligning our field organization with continued focus around market groups, industry verticals, and global expansion with partners. This evolution will impact how we structure and scale the field organization in the future. We'll continue to update you as this evolution progresses, and what are the appropriate metrics around go-to-market investments.

Regarding services, education and [proserve] represented 8% of revenues in Q3, in the range of prior and expected levels of between 5% and 10%. Remember, since we generally recognize revenue on services when they're delivered and billed, services bookings typically do not flow through the balance sheet as deferred revenue.

Turning to margins, which are all non-GAAP. Q3 overall gross margin was 89%, in line with prior quarters. Operating income was about $3 million, representing a positive margin of approximately 2%, better than our expectations due to higher than forecasted revenues.

In addition to our excellent field execution, it's also important to note the velocity coming from our products group. As Godfrey mentioned, we announced several important product enhancements at dot Conf, and I'm pleased with how our continued investment in this area is translating into more customer success.

Q3 non-GAAP income was $2.4 million, and EPS was a positive $0.02 per share, based on a fully diluted share count of 126.9 million shares. Cash flow from operations was $24 million, and free cash flow was $20 million positive, and we ended the period with about $960 million in total cash and investments with zero debt.

Now, looking forward to the rest of the year, we expect total revenues of between $135 million and $137 million in Q4. Consistent with prior years, we expect Q4 will be our most profitable quarter of the year with positive non-GAAP operating margin of between 4% and 5%. With our year-to-date performance and our Q4 outlook, we now expect total revenue for the year to range between $438 million and $440 million, up from our prior guidance of $423 million and $428 million in total.

We now expect to generate positive non-GAAP operating margin of between 1% and 2% for the full year, as we continue our investments in our market groups, product teams, and Splunk Cloud offerings. Remember, because we expect to be profitable on a non-GAAP basis in Q4 and the full year, you should use a fully diluted share count for your EPS calculations for these periods. We will continue to run the business cash flow positive, and with our overachievement year-to-date, it now looks like operating cash flow will be closer to 21% to 22% of total revenues for the full year.

Looking forward a bit farther, I thought it would be helpful to give you some insight on how we're thinking about next year, which is FY16. With current inputs and visibility, we expect total revenues of approximately $575 million next year with seasonality trends following FY14 and FY15 patterns. At this level of overall growth, we expect to remain in investment mode as we continue to expand the product portfolio and our field reach globally, and we'll continue to run the business with these investments in mind. As a result, we expect full-year non-GAAP operating margin will be comparable with this year's performance.

In closing, our team continues to execute on our mission to deliver exceptional value to our customers. Q3 was solid, and I'm enthusiastic about our outlook for Q4 and FY16. Thanks much for your time and interest. With that, let's open it up for questions.

(Operator Instructions)

Our first question comes from Raimo Lenschow from Barclays. Please go ahead.

Let's go to the next question, please.

Our next question comes from Brent Thill from UBS. Please go ahead.

Good afternoon. Godfrey, on the security side, I was curious if you could just talk through what you saw in the quarter. I know this has been an important vertical for you, and certainly from the user conference, there was a lot of excitement around how did that perform? And, what are you seeing in terms of some of the dynamics in that end market that you're serving?

Hey, Brent.

So, security is one of those markets where you don't want to brag too much because it's just -- because it's such hard work protecting companies against all the stuff that's coming our way. But, what has really happened in the market is that everyone sort of gets now that success in security is about big data analytics. It's not about a static rules engine on top of a relational database anymore.

It's about being able to analyze data and look for patterns and trends, and if there was any really pretty interesting stuff that came out of all of our customer presentations on this topic, it was how they were finding things that they never knew they had. And, almost all of them would say, yes, we had been attacked and we had actually been breached in some way, and we never actually knew it until we had Splunk analyze all the data.

So, this market is moving pretty quickly in our direction, just because it's clearly an analytics play, not a reporting play. I think it was probably close to 40% of our business in the quarter. So, it was very strong for us.

Okay. And, for Dave, real quick, you mentioned at the conference a more linear price list that is easier for your clients to understand. I'm curious how that's starting to resonate in some of the early sales cycles with that?

As you recall, Brent, we modified our pricing at the entry level. The lower SKUs where we doubled capacity earlier in the year. We haven't formally modified the rest of the price list, but if you look at that curve now, you can see that it is clearly more linear. Importantly, what we did is we published it on our website.

It wasn't transparent to customers, so they were left to their own devices to extrapolate costs at higher data volumes based on entry level pricing SKUs. So, that was an important step.

We are looking at other programs that we've talked about in terms of how we enable adoption and give customers the predictability that they need in terms of TCO on the software. But, that's something that we haven't formalized yet in terms of external visibility.

In addition to publishing the price list and really, I think that has reduced the angst quite a bit, just because you can see what the general pricing is per gig up at larger data volumes. The other one pricing action that we took in the quarter was the announcement of Hunk, which is now available in the elastic map reduce stack available on an hourly basis, consistent with that. So, that's another easy way for customers to get started.

Thank you.

Thanks, Brent.

Our next question comes from Phil Winslow from Credit Suisse. Please go ahead.

Thanks, This is Siti Panigrahi for Phil. Congratulations on another good quarter.

Thank you very much.

Just wanted to touch on the deal size. Looks like you had another good quarter in terms of deal size metrics. Could you give us some more color there on just what you have been seeing? The customer new and existing deal sizes? But also, as you try to upsell Hunk and other -- some of these add-on modules, and in fact, Cloud too. How that's impacting your deal sizes, and how should we think going forward?

Thanks.

Thanks for the question. It's Dave.

When we look at -- obviously, we give metrics around large orders in the quarter, but I also mentioned that we in the second consecutive quarter recorded our total -- the total number of transactions exceeded any number in the past. So, when you look at the combination of large orders and total transaction velocity, there is a certain amount of consistency in terms of ASPs. I'd say for three years running, ASPs were consistently between $30,000 and $40,000.

Over the last, say, couple quarters, I will admit that there has been a slight uptick in terms of ASPs overall, but not anything that I would point to say we've established a new trend. We are watching it, and if we think that trend is uptick, then I'll give you that update.

In terms of overall order size and how other products are affecting that, I don't think there's a direct correlation between average order size because of new products or not. Typically, customers still come in. They may try the free download. Obviously, thousands of customers are trying Splunk in the Online Sandbox, and they may start small. That's a typical order for a new customer. And then, grow and expand their use in a single use case or horizontally.

Again, we talk about upsells and two-thirds of upsells being horizontal expansions in the enterprise and over 70% of licensed bookings being upsell. So, we see a tremendous amount of expansion from customers in terms of use of the core product.

Inherent in those upsell statistics are the consumption of incremental products like Hunk and like our ES app for security. So, initial sale ASPs -- no direct correlation. Upsell and expansion in the enterprise, clear correlation in terms of consumption of extra products.

That's helpful. Thank you.

Thank you.

Our next question comes from Ed Maguire of CLSA. Please go ahead.

Hi. Good afternoon, everyone. I was wondering if you could comment on how the market groups structure may be impacting sales cycles. In other words, now that you've combined a lot of domain knowledge, is that resulting in shorter sales cycles for you?

Hey, Ed. Nice to hear your voice.

Well, couple of comments on that. One is that if Haiyan is any reflection of how this will turn out, we're off to a really good start because the field had that lady on airplanes almost nonstop since she started. She's like the most popular person in Splunk any more to go with customers, especially to a security customer. In fact, they never even call me anymore. I'm kind of waiting for the phone to ring.

But, it helps to have folks who are experts in their field. And so, I'm just thrilled that Marc is here to help us with Cloud leadership and that Rick Fitz has joined coming with two decades of experience in the ITOA segment. It helps a lot to have people who are able to come as a subject matter expert at an exec level. I couldn't be happier about it.

I'm just impatient for us to get further along. I would argue that it will help us shorten sales cycles by having the field have resources at their disposal that can help them in that content.

Great. I actually was intrigued by the managed security services deal you announced on the Cloud and whether this is a harbinger of potential service-type solutions that either you or your partners may start to offer. Is this the beginning of a potential new business model for partners or even Splunk managing applications?

All of the above. So, it's really interesting to watch the Cloud activity evolve.

We have everything from small users who are coming online -- they come to the Online Sandbox and use it for a while. And then, convert that to a paid piece of business, which is relatively low touch. All the way to some very sophisticated projects like the one I talked about today, which was our largest transaction of the quarter, and you can bet that was a very intense, solution-oriented POC with a lot of proof points involved along the way. As in, can you do this to our satisfaction as a service provider? And, that's what I see.

Ed, I think it was probably a year or two ago when I was asked the question, how did I think the Cloud would play out. To that then and to this day, I believe that it will be more about solutions than it will be about just raw indexing. And so, I believe our MSPs will be -- our partners will be great evidence of using Splunk as an integrated technology providing a solution like helping customers outsource their app monitoring and remote data center -- call it a Cloud -- to do that with confidence, you need both technology and expertise. I really do believe that this movement to the Cloud is going to be very much a solution discussion, not just an indexing discussion.

Great. Thanks so much.

Thanks, Ed.

Our next question comes from Raimo Lenschow from Barclays.

Let me talk quick. Congratulations on the quarter. I was at the SplunkLive event in New York. One of the things that came across there was that you -- it seemed as more line of business people at these events, and it seems almost like you're getting into different bunches as well. Is that the wrong observation? Or, can you talk on that theme a little bit? Thank you.

Raimo, welcome back to the queue. We couldn't hear you that first time through. But, thanks for your comments.

Well, a couple of comments on that one, which is I gave a presentation a couple of weeks ago to a group of about 25 Fortune 100-level CIOs. And, one of the power points that I had in that was an org chart, a CIO org chart, and I showed them all the different departments that report somewhere to them that we serve and how many different solutions we provide to those different buying centers.

And, I think they were a little shocked at how many places we are in their organizations. It was funny, as the conversation went around the table, every single one of them would start out the conversation about saying, well, my team loves Splunk, but here's what they're doing with it. And, there were so many different examples.

And, pretty soon we all came to that same conclusion, that, A, we're starting to move out into the line of businesses now, not just inside the CIO's organization. And, B, we're in so many places that I think one of them accused me of selling crack, and this was really about Splunk sells drugs and then the customer ultimately has to pay for it. And, it was done in great -- with great humor and with affection.

But, it shows, again, the challenge we have of how much our field organization has to learn in order to be able to service the market opportunities we have. And, it also to some degree reflects on the need for more partners, because the amount of specialization that our technology enables is more than we can handle.

So, yes, to your comment about New York, we had 500 people there at the SplunkLive, and some fantastic customer presentations and thanks to you who attended. And, it just -- it's more market opportunity. And, yes, starting to move over in the lines of business.

Perfect. Thank you.

Thanks, Raimo.

Our next question comes from Keith Weiss from Morgan Stanley. Please go ahead.

Thank you for taking my question, and again, congratulations on a very nice quarter. I wanted to delve into ales productivity a little bit. You saw accelerating billings growth in the quarter on tougher comps, which is no easy feat. It seems to be on sales headcount or growth that isn't quite up to where the billings growth is. It seems like you are seeing improving productivity of that sales force. I want to, A, vet that with you -- is that a true statement? Is sales force productivity improving? And, what do you think is driving that? How sustainable do you think that is going to be on a going-forward basis?

Thanks for the comments.

Our ASPs are creeping up a little bit, in spite of the fact that our sales rep hiring process is just 2 points lower than where we have been historically. And, I think the words that you heard said a couple of times during the call were signed enterprise agreements with large customers. So, at the same time that we have a lot more activity -- higher volume activity in terms of more new customers coming in at the low end because of our price moves, which is great. We're bringing in more customers into the Company.

We're also writing more large contracts for enterprise adoption with our big customers. So, you add all that up and stir it up, and you get a slightly higher ASP and really healthy billings, even though the headcount growth was slightly lower than what our trend line has been. So, we still expect to end the year -- what, Dave -- 300, 310, something like that?

That's right.

We continue to invest. But, next year we also have to invest. Doug Merritt will say over and over, we have to continue to invest in technical resources in the field because our customers need -- they're buying solutions and they need people out there who understand how to help them get that done. So, the mix coming up this year is going to be just a little different than it has been prior in terms of more technical resource. But, I think it's a good thing for us long term.

Keith, it's Dave.

We've talked many times about productivity and all the steps that we take around enhancing productivity and what is time to full productivity at Splunk is longer than it is, I think, for a typical enterprise software selling environment. Again, it's to Godfrey's earlier point, as he explained the feedback from the group of CIOs, the breadth of applicability of our product across so many use cases in several markets, i.e., hence our investment in market groups and having Haiyan and Rick join the Company. It's a really unique selling environment, and certainly one that's challenging to create consistency across the sales organization.

And, the need for those technical resources is not a new topic, and we've talked about it a long time. As a real gate in terms of the rate at which we hire pure quota is as much governed by the rate at which we have fully enabled sales technicians in the field. While we are proud of the ease of download and immediate usability of Splunk, when you get into multiple use cases and data sources, complexity grows.

So, the pace that we add resources is a daily challenge. It's one that Doug and I are always arm wrestling about in terms of the rate at which we invest in which region, in which country, what type of skillset is it. If Haiyan was in the room, she'd say, of course, they should all be security.

Now that Rick's here, I know Doug and I are going to be refereeing those two -- saying no, no, they're all Internet, or ITOA. No, no, they're all security. We've got a lot of greenfield ahead of us in terms of getting that critical mass in the field, so that we can actually plow through some of these fits and starts that we experience around time to productivity or sales cycles because we're just stretched so thin when we get into specific use cases by region or country.

Got it. And then, if I could sneak one more in. In terms of those enterprise adoption agreements, you talked a little bit at Analyst Day about trying to improve the process, if you will, getting those a little bit more standardized. Can you talk to us about any progress that you've made there in terms of getting the selling motion for those a little bit more standardized in the sales force?

We've certainly made progress in terms of how we're structuring the program and getting feedback from our field reps as well as select customers in terms of the ease of consumption of the way we want to introduce the concept. But, we haven't formally rolled it out. I think we'll do that, Keith, at our annual sales kickoff program, which happens at the beginning of next fiscal year. That's kind of our target date. Once we've formalized it, communicated it to our folks, then I'll share it with all of you.

Excellent. Sounds great. Thank you.

Thanks, Keith.

Our next question comes from Kirk Materne from Evercore ISI. Please go ahead.

Thanks very much. Thanks for taking the question.

I guess, Godfrey, I was curious about your comments on analytics. I was curious if you could give us an idea of where do you see the analytics business in 12 or 24 months, vis-a-vis what you've seen with security in terms of another opportunity that maybe is a standalone business unit unto itself? Where do you think we are along that journey? Obviously, the move to put security as a standalone unit has really helped, I think, accelerate that business' growth. I'm just curious what you think the opportunity for analytic is in that vein?

I couldn't agree more with you. I'm so impatient on this stuff. It just takes time to build organizations. I'm delighted that Rick is here. I think a year from now, we'll have enormous progress, even better than what we do in our core business around ITOA, and the very next one after that, in my humble opinion, is the whole business analytics piece.

The reason I feel so strongly about it is because it's a natural outgrowth of our customers who start with us, using security or ITOA use cases. The more data they put in and the more they understand what's possible -- what kind of value can be gained from looking at time series data -- pretty soon everybody goes wow, look at this, I didn't realize this. But, I can do X or Y. And, it's a natural outgrowth of where we start in IT or security and so it just makes sense for us to put more horsepower behind it.

So, yes. Sorry, I could go on. You get me cranked up on this, and I could talk about it for a while. I think the short answer is, yes, I believe that that will be the next one, and I'm as equally impatient on that as everything else I do.

If I could ask a really quick follow-up. You obviously had a pretty big presence at AWS this year. How do you view AWS as a potential channel for you? Is that something that could ultimately be meaningful in terms of bringing new customers to Splunk through AWS when you look out three to five years?

I do. I believe it's an important relationship. We have a lot of customer interest in moving production apps to the Cloud. AWS would love to transition or grow from the -- and, they are already -- but, grow from the place that's known for dev test and burst mode use to having ongoing production environments there.

That's a major objective for them. And, I believe Splunk's one of the Companies that can really help them. So, it's a natural partnership, and I believe there will be a lot of good that comes out of it. So, we're bullish about it, and so are they.

Cloud is just another way to grow. I guess, if anything, I still struggle a little bit if I'm a field person for Splunk and now I need to go to a customer and have a solution conversation with them. It can't be about, let me tell you about Splunk Enterprise. Now it has to be about what problem are you trying to solve it, and we have a variety of ways to help you solve it.

We can solve it for you by some of our core products. We can help you in the Cloud. We have solutions to offer. We have MSPs, and we have partners. There's a variety of ways to skin every cat. I think one of the growth dimensions for our field organization this coming year is learning how to help customers evolve and consider all those good choices.

Great. Thanks and congratulations on the quarter.

Thanks very much, Kirk.

Our next question comes from Greg Dunham of Goldman Sachs. Please go you ahead.

Hi. Yes, thanks for taking my question. I wanted to follow up on a combination of Brent and Ed's question. Really is there any way to disentangle the benefits that you're getting from a market backdrop in security, moving to big data analytics versus what you're doing from an organizational standpoint? Specifically, are the changes in having a dedicated functional organization in security, is that having a big impact today? Or, are those changes more on the come?

I would I say that the security market group, which was only formed in February or March, is now starting to really hit its stride. So, if I think that any organization, it takes it really a year to form up and get its motion going, but it -- . Haiyan's team is looking at everything about the strategy of being the best possible solution in that market, and that goes all the way from product definition, out to go-to-market structure, partners, ecosystem and other apps, and other companies that help make that up. Because Splunk isn't the only technology that it takes to be a part of the modern security or defense architecture. There's a number of other companies and technologies that make up that total formula.

But, for us to have a strategist like Haiyan who understands all those dimensions and can help us invest in the right places in order to be the best possible player in the security market is a really, really good thing. And so, to be able to take that model and copy and paste it over to our other major usage areas just makes absolute sense for the Company.

But, it takes a little bit of time for them to form up. So, I always think that between six months and a year after formation, those groups will be having a high impact on the business. And, of course, the reason why the Cloud has been so good is because I was the acting manager. That's clear. (laughter)

Clearly. One more from me.

International growth. That wasn't as strong as it has been in the last couple quarters. Are the plans to do anything to maybe ramp up the investments there? Or, get that going more? Or, what did you see specifically in the quarter? Thanks.

Oh, I think international was about even with Q3 of last year and down a couple points from the prior quarter. And, I would say it had more to do with the strength in the US than it did with anything else, because those guys had very healthy growth year to year.

Their ever-present challenge is trying to figure out how to grow faster than the US. Some quarter -- most quarters, they do. Every now and then, they wind up taking second, back seat to the US. Our largest order of the quarter that I mentioned earlier, that was a US order. Those kinds of things do matter in the numbers.

Well, and we had a particularly strong quarter in the public sector.

Public sector.

Federal year-end. I mentioned in my prepared remarks, year-over-year the contribution internationally was actually the same as Q3 the prior year. Q3 tends to be that dip quarter for those guys, I think, again, on strength of public sector.

Public sector. All that. Anyway, they'll be back next quarter.

Okay. Thanks.

By the way, it was a real challenge for the CFO to negotiate with the GM of Cloud around investments when he was also the CEO. Marc, I'm really glad you're here if you're out there listening. (laughter)

Our next question comes from Brent Bracelin from Pacific Crest.

Thanks. Had two follow-ups, if I could, on Cloud and security. On the Cloud side, you talked about growing Cloud over the medium term to 25% of revenue. I guess, Dave, maybe if you could quantify where Cloud is today. Is this 5%, 10% of revenue?

Godfrey, as the acting manager of Cloud. Wondering if you could provide more color on the seven-figure Cloud transaction? Is this an anomaly, or are you seeing a preference shift where the appetite for Cloud option is increasing or decreasing? Any more color there would be helpful.

Hey, it's Dave.

Just to clarify, the statement about the medium term was 25% of the business. So, clearly the revenue contribution would be lower than that, and it's significantly below 10% today as you would expect as it continues to ramp, ratably recognized compared to our on-prem business which, again, back to mix, excluding Cloud transactions, 34% of license was ratable this quarter which means 66% was not. So, from a revenue contribution perspective, I see a long tail before Cloud becomes a material number that we would be disclosing.

That makes sense. (multiple speakers) In terms of color on the transaction? Yes.

I want to talk a little bit about that transaction, and then I want to talk a little bit about how the overall landscape is -- I see it shaping up. On this one particular transaction, it was very much a solution sale. So, this is a customer who knows us. We already have a good reputation with them. Actually, in a business analytics use case. And, they had a very specific need to -- they wanted basically to move their SOC to a place where it could be managed for them as a service.

So, we effectively stood up a very large scale, like a 10-terabyte-plus POC on Amazon, and because they didn't have to go through all the months of procuring hardware and standing it up and testing it and doing all that. They didn't have it ready. We were able to shorten the cycle from interested in doing the POC to doing the POC from months down to a couple of weeks. And, Amazon was a great partner in terms of helping us get ready for that.

Once we did the POC, then all the focus was on the software. It wasn't about having to tune the STACK or all the stuff that you do on the data center side. That was all -- we took care of all that. So, during the POC, 100% of their focus was on just the software functionality. Did it work correctly? Did it provide the solution that they were looking for, and were their analysts able to concentrate on the security usage while we ran the thing for them? And, that's how it worked out.

And, of course, the beauty of having started that POC in Amazon was that once we finished the POC, you're effectively ready to provision and move to operations with just a flip of the switch. So, it's actually quite an interesting study in terms of how you can shorten a cycle time for a POC by having us do it for you. And so, it's a one-off right now because it was a specific project. But, I think it is the harbinger of how future customers will want to focus on using the software, not on managing the software.

Fair enough.

I think we'll see more of that. But, no, that was a particular project.

Now, on the landscape side, the market is really evolving into a few segments. And, one is, customers who have most of their hardware and software on-prem and are just starting to do some Cloud stuff. They're -- that's one pretty big segment around the world. And, for that, we can solve all their on-prem needs and help them as they experiment in the Cloud. There are other customers at the other end of the extreme who do everything in the Cloud and really just want us to mash up all the data that's in the Cloud so they can correlate and analyze that.

And then there's the middle ground. And, part of the beauty of Splunk as very flexible software is that we can handle almost any mix of that customer need. So, we can handle international. We can handle domestic. We can handle any mixture of Cloud plus on-prem.

It just means that we have to go in and ask the customer, where are you going and what upcoming projects and how are they managed? And, because we can map to any combination of those, we're in pretty good position to help them get from wherever they are to wherever it is that's a mixture of where they want to go. It's pretty fun.

Helpful color. I'll leave it there. Thanks.

Thanks.

Thank you.

Our next question comes from Daniel Ives of FBR Capital Markets. Please go ahead.

Hello. This is Chip Moore in for Dan Ives. Great quarter.

Thank you.

Can you just give us an idea, maybe some of the puts and takes when you are thinking about 2016 initial guidance? And, just vis-a-vis the 40% of your business in the quarter was security and then the strong Cloud performance?

Sure. As you know, we start with what we expect will be our capacity in the field. As I mentioned in the prepared remarks, we're in the midst of the planning phase, and we're measuring what did those investments look like in terms of mix of direct quota participants, inside, outside, industry specialists that align to the markets, core verticals.

What's the momentum we expect from Cloud and how will that affect the geography on the income statement between revenue and deferred revenue? And, of course, impact on margins, given that there are obviously costs in terms of delivering a service. So, all of the components are currently in the mixer, and we're staring at them in terms of the operating plan.

From a revenue perspective though, it's tied back to capacity, customer velocity, and the big variable -- the one that absolutely drives me crazy, and I know you love it, too, is well, what's that mix going to look like. What's going to be ratable? What is going to be up front and what is it on an annual basis and what is it quarterly. Obviously, if there's less ratable upfront, you'll get more revenue as a tail through the back half of the year.

So, those are the inputs that I'm staring at today. Capacity, mix, and overall customer velocity, and then mix of product as well. It's not just accounting, but with the velocity we see in Cloud, there's an impact on that today.

Operating expense and the details and the investments -- we're going to continue to invest in product groups. We're going to continue to invest in our field coverage model. We're going to continue to invest in our services. We'll sprinkle a little bit into G&A to make sure we can scale the organization.

Or not.

Well, now that the GM of the Cloud is back to being full-time CEO, I'll probably get a little more scrutiny on the G&A investments. But, we're still going through that whole process and measurement. But, I think the important message around top line and margin is we're in investment mode, and we're going to continue because we think that our penetration of the TAM is at the very earliest inning.

Very helpful. Thanks for the color.

Thanks, Chip.

Our next question comes from Derrick Wood of Susquehanna. Please go ahead.

Great. Thanks. Nice job on the quarter. Wanted to talk about the Cloud and the growing demand that you're seeing there. As you look at the LAN portion of a deal, is it mostly a greenfield, machine data project? Or, would you expect the installed base to maybe look at shifting some on-prem over to the Cloud. And, I guess if the latter, how do you manage that process from both a customer contracting standpoint as well as a commission payout standpoint?

Okay. Gosh.

When I look at the mixture of Cloud transactions in Q3, they pretty much mirror our on-prem activity. That is, the ratio of, say, app, app dev, or app monitoring-type use cases, IT ops and security, if you just think about the big three. The mixture of what we're doing in the Cloud roughly equated to that, if you take out the one large transaction which was a security -- like you'd screw up all the metrics if you used that one. But, if you take that one out, then the rest of the pattern diagram looks pretty much like our core business. It's just these were customers who preferred to go Cloud.

They came to us from a variety of different vantage points. Some were Sandbox conversions. Some came in through our field organization. The rest of them all came in through our field organization. Some through the inside sales team, some through the outside sales team. There's a large -- just a really nice mixture of where they come from.

To the question of converting on-prem deployments to Cloud use cases, we are seeing the very beginnings of customers who are starting to move their on-prem apps, either future builds or even current ones, to lower cost infrastructure. And, it's no more complicated than if you and I want a cup of coffee, we plug our coffee pot into the wall. But, we don't expect to have to string wiring or build a power station in order to get electricity. So, as Amazon becomes the utility grid provider, it's a lot easier for customers just to not do that but to go run their apps, just pay for the infrastructure by the year, or other -- whatever the charge structure is. We haven't seen too much of that yet.

When Coca-Cola presented at Conf, Michael Connor talked about that and said all future Coca-Cola apps for the consumer division are being built in the Cloud, and he has built a consistent architecture including Splunk as that referenced monitoring engine on Amazon. And, he can turn on effectively a new grid for an application in 10 minutes. So, the whole point being why would I do that the old way if I can do it in 10 minutes the new way and skip all that stuff. This is a of movement, and that's why I believe that in a few years it will be 25% of our business. That it could be more.

Now to your specific question about how do we handle that, how does the -- that's probably a little too much to handle on the call. But, maybe a as we get a few more of them under our belt, we can come back and give you some color on how we manage all that stuff and the difference between what somebody was paying us for a license there versus Cloud and compensation. That's a big -- that's a long topic. If you don't mind, I'll defer answering that one until maybe a future time when I have a little bit more context for it.

It sounds like it's still too early for that. If I could squeeze one more in. You have obviously done very well with the segmentation in security. It sounded like you're starting to do some segmentation in ITOA?

Yes.

Is that a correct assessment? Can you shed some more light on that?

Well, yes, of course. It has been our core market. It's how Splunk started as a Company was to be able to do IT operations, troubleshooting, and monitoring and alerting and all that sort of thing.

It kind of expanded from the guys who run the servers to the adjacent departments of the app build and desktops and networks and everywhere else. It kind of spread. Our base from the very beginning was IT operations. That, in and of itself -- the apps and ops use cases are very specific and have a very different dynamic, different set of partners, different value metrics, different ROI than, say, a security use case or a business analytics use case.

To have a leader, in this case, Rick Fitz, joining us to help us define that marketplace, strategy, partners, ecosystem, apps, solutions, all the marketing messaging, field readiness. If you just think about that soup-to-nuts marketplace and what the customers' needs are, it really helps to have a senior leader who's been in that part of the world for a long time.

And so, this was our -- if security was our first one, ITOA would be the natural second one to go after because it's our core business. And then, business analytics -- Cloud, and then business analytics will be the one after that. So, yes, I think it's important for us to do, and it's the only way that we can begin to capture the market opportunity. When the market opportunity is that broad, you have to put some focus on it.

Great. Thanks again.

Thanks, Derrick.

We have time for one final question from Aaron Schwartz of Macquarie. Please go you ahead.

Good afternoon. Thank you very much.

Godfrey, you mentioned a couple times the value in the solutions, and presumably when you start to have those conversations and installations, it makes the customer -- or your technology that much more sticky to the customer. You also mentioned a lot of the partners involved there. And, I'm just wondering how you view the line in the sand for what you need to own on that side? What your partners own? And really, how you make sure you monetize that properly?

Gosh, that's a good question. I'm not sure I thought about that much today in terms of where to draw the line in the sand. I would say that we would welcome as many partners as want to make a significant investment in the business with us. Maybe the difference between where we were three or four, five years ago and today is that as we move from just what used to be simple troubleshooting, alerting, logging if you will, it was logging. Now, to a much more sophisticated set of use cases that have often times -- we're a mission-critical part of an app dev scenario. Or, we're monitoring a large-scale data center or we're involved in a huge security project.

You have to have some expertise to meet the customer requirement at that stage. So, our definition of what makes a good partner is more mapped to our use cases now than to just core logging. As we define our partner map and how many of them and in what countries and what value do we bring to each other, fewer partners that are deeper in terms of their Splunk investment is probably how you'll see that evolve.

And, just in terms of verticals, obviously you've talked a lot about security. Do you think you need to own some vertical expertise in other areas? Or, is that more the role of the partners?

Both. So, for example, as we form up a more complete security market group, they will have partners that are security market practitioners that become very, very important to our Business. I think you'll see alignment between the markets and those use cases and the partners that map to that.

There's a very strong partner network around the world that's focused on security because so many of the other security vendors like Palo Alto and so forth sell appliances which are delivered to those geographies through partners. So, there is a natural partner group out there called security-focused partners, and we want to have very strong relationships with the best of them because we're a part of that security solution and partners are really great at bringing that multi-vendor stack to the customer. So, I just think it's more about alignment than anything else.

Thank you.

Thanks, Aaron.

Thanks.

That concludes our Q&A session. I'd like to turn it back to Ken Tinsley for closing remarks.

Great. Thanks, Eric. Appreciate your help today, and thanks everybody for joining us. Hope you have a great night and a good Thanksgiving.

Ladies and gentlemen, this does conclude today's conference. Thank you for your attendance. You may now disconnect. Everyone, have a great day.