Splunk Inc (SPLK) 2016 Q2 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the Splunk Incorporated second-quarter 2016 financial results conference call.

(Operator Instructions)

As a reminder, this conference is being recorded.

I would now like to hand the meeting over to Ken Tinsley, Vice President of Investor Relations and Corporate Treasurer. Please go ahead.

Thank you very much, Karen, I appreciate that. And, good afternoon, everybody.

With me on the call today are Splunk CEO, Godfrey Sullivan; CFO, Dave Conte; Head of Worldwide Field Operations, Doug Merritt; Head of Security Markets, Haiyan Song; and Head of Cloud, Marc Olesen. We issued our Press Release after the close of market today, and it is posted on our website. This conference call is being broadcast live via webcast. And, following the call, an audio replay will be available on our website.

On this call, we will be making forward-looking statements, including financial guidance and expectations for our third quarter and FY16 transaction; product and services mix; planned investments including products services, sales, Cloud facilities, and geographies; expected benefits from our recent acquisitions; and trends and momentum in our business, including Cloud business and impact on our margins. These statements reflect our best judgment based on factors currently known to us, and actual events or results may differ materially.

Please refer to documents we filed with the SEC, including the Form 8-K filed with today's Press Release. These documents contain risks and uncertainties, and other factors, that may cause actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP to non-GAAP results is provided in the Press Release, and on our website.

With that, let me turn it over to Godfrey.

Thanks, Ken. Hello, everyone.

We had a great to Q2. I want to thank our customers and partners for their enthusiastic support, and our Splunk employees for their many contributions. Total revenues came in at $148.3 million, up 46% over last year. We're delighted to welcome more than 500 new customers to the Splunk family. And, we now have more than 10,000 customers worldwide.

The highlights of any Splunk quarter are always about our customer success. I was really happy to see some of you who attended our recent SplunkLive San Francisco, where our customer Sephora spoke about the challenges of deploying their in-store mobile point-of-sale systems. Splunk helped them reduce failed customer transactions by 95%, increased customer satisfaction and doubled the revenue through their mobile point-of-sale systems. Sephora said, quote, Splunk has helped us move from ambiguity to transparency.

Also at San Francisco, Equinix explained how, after deploying Splunk Cloud as their security intelligence solution, they went from monitoring 20 billion raw events across multiple silos, to just 20 daily actionable alerts. All through the correlations and analytics in our security app.

You can check out these and other great customer presentations on our SplunkLive.com website. Our customers continue to create impressive new use cases, and they also guide our investments into new solutions areas.

Moving onto products. We closed two Acquisitions in Q2, Metafor Software and Caspida. Metafor provides anomaly detection and behavioral analytics for IT operations use cases. Caspida provides data science-driven behavioral analytics for security use cases. This Acquisition is aligned with our strategy of expanding our cyber security offerings, and will enable us to bring more advanced analytical capabilities to our customers. We are pleased to welcome the Metafor and Caspida teams to Splunk.

A reminder to everyone on the call, our User Conference is coming up in September. And, our Product teams will be making an impressive set of announcements, including the launch of our new solution for IT service intelligence. And, of course, an exciting new release for Splunk Enterprise. I hope to see you there, and we'll certainly be ready to celebrate with you.

On the call with me today, Doug will provide our Field report, Haiyan will cover Security Markets and Marc Olesen will provide an update on our velocity in Cloud. As always, Dave Conte will mesmerize you with his financial update.

Let's go to Doug.

Thank you, Godfrey.

I'm really proud of our field organization, for delivering another strong quarter in the first half of the year. We are rapidly building our customer-facing organizations to support four initiatives. First, we're concentrating our headcount expansion to major countries, where we need critical mass to better support our customers. During Q2, we added more than 100 global field positions.

Second, we're aligning our field technical resources with our market groups, to ensure that we can deliver a best-in-class customer experience in our core solutions areas. Third, we're investing in our customer success organization. This is a team that works with customers to drive ROI, value realization and expansion of those critical Splunk use cases. Finally, with our channel partners, we're concentrating our focus and our economics, to ensure that those who invest in Splunk capabilities see a higher return on their investment.

Public sector is a great example where we've invested heavily, to create teams that are dedicated to federal, state and local government. And, a new team dedicated to higher education. Great examples of our work in public sector in Q2 include the United States Marine Corps, who chose Splunk Enterprise as the anchor of their new IT operations. And, a federal agency who purchased Splunk Enterprise, ES and Hunk, to correlate and analyze terabytes of data across multiple Hadoop environments.

We had continued momentum in the state and local arena, as well. The state of Utah bought Splunk Enterprise and ES to identify suspicious events, by correlating data from firewalls, systems, devices and applications. And, many other great wins, including New Mexico Human Services, Pennsylvania Department of Transportation, Washington DC Health Benefit Exchange and the San Diego Sheriff's Department.

I'm also really pleased about the acceleration of our new, higher-education team. In addition to having more than 500 higher-ed customers, our software is now being taught, or used for research, at more than 100 universities. Stateside, colleges like Georgetown, Northwestern, San Jose State, and UC Boulder. Internationally, Singapore's Nanyang Polytechnic, Italy's Sapienza and the UK's Oxford, are among the campuses supplying the workforce of the future with a way to learn Splunk skills, reflecting the high demand that we see for these skills in our customer base.

As Scott Wheeler of Northwestern put it, students need to understand the power of combining unstructured data with the structured data that businesses already collect and manage. Integrating Splunk solutions into our curriculum gives them access to a simple-to-use platform, that can change the competitive stature of any business.

I also want to compliment our Americas team, who continue to lead with excellence. They had an impressive Q2, driving enterprise adoption agreements with multiple customers, including Staples, for IT operations, application delivery and customer analytics. As a reminder, our EAA program enables customers of any size to purchase unlimited licenses with fixed, predictable costs. Other customer wins included Barnes & Noble, for application delivery; and Yelp, a new multi-terabyte customer for business analytics.

As we continue to ramp our international coverage, I'm pleased to announce customer wins including Samsung Semiconductor, a new customer in Internet of Things. And [Atlassian], who saw the benefits of Splunk over prior open-source initiatives, and signed an unlimited EAA to standardize on Splunk.

Finally, I'd like to call out a few partners, including Amazon, where we teamed to win Cloud orders at Chicago Public Schools, and Arlington County, Virginia. And Kepware, one of our partners for IOT data, who received an award for 2015 Product of the Year by IOT Evolution magazine, for their industrial data order for Splunk.

In summary, it was a great quarter. Healthy breadth of orders, geographic diversity and Splunk continuing to become a platform that spans multiple departments, supporting a wide variety of these cases. Our team also did a fantastic job in the Cloud, where our ability to handle on-the-prem and Cloud is a significant advantage.

For more on that, let me turn it over to Marc Olesen.

Thank you, Doug.

Our Q2 results show continued acceleration in our Cloud business. We tripled our orders in nine months. Our customers are excited with the speed and ease of Splunk Cloud. They are happy to focus their time and attention on analyzing the data to achieve their business results, rather than procuring and deploying equipment. As a reminder, Splunk Cloud is available through nine AWS global regions, and is now available on US GovCloud as well.

There are three paths to Splunk Cloud. The first path is our web self-service platform, to trial and purchase Splunk Cloud with a credit card. The second path is with our field and channel, where new customers choose Splunk Cloud as the deployment model to accelerate time to value. A few of the customers we added in Q2 include Tenneco, Pernod Ricard in France and Australia's Unify Solutions.

The third path is where our existing on-premise customers are expanding their capacity with Splunk Cloud, and deploying in a hybrid mode. A few of our hybrid customers this quarter include AAA, city of Austin and London's Gatwick Airport. We continue to hear from customers that the ability to run a hybrid solution is incredibly powerful and important to them. And, Splunk is uniquely positioned to deliver on that.

Some notable wins this quarter included InfoSpace, who replaced a competitive cloud-only, log search company with Splunk Cloud, and the Splunk app for AWS. We are helping them enable continuous delivery to their web-publishing customers. Geico, an existing Splunk customer, expanded with Splunk Cloud, taking advantage of the Cloud's favorable TCO. Maxim's Caterers, the biggest food and beverage company in Hong Kong, selected Splunk Cloud and our app for PCI compliance, for securing and analyzing their e-commerce data.

And our largest Splunk Cloud order this quarter was from a social media company that signed a seven-figure order, for a multi-terabyte instance. This existing customer is expanding with Splunk and plans to transition from on-prem to the Cloud.

Customers want to know that their workloads are as reliable and secure in the Cloud, as they are on premise. Splunk is there to help customers move to the Cloud with confidence.

And now, over to Haiyan.

Thanks, Marc.

In Q2, we had great momentum and continued to strengthen our role as the nerve center for security. We, again, delivered triple-digit, year-over-year bookings growth for ES. Customer demand for solutions that deliver faster time to value has driven the growth of ES, on-prem and in the Cloud. Here are some of our customer examples.

The Securities and Exchange Commission extended their use of Splunk Enterprise and ES, as the security analytics platform, where all IT and security data is monitored, analyzed and reported. Next time you're enjoying a legendary steak at your local Texas Roadhouse restaurant, think of Splunk as their nerve center. Splunk gives the security team better ability to detect, follow and shutdown attackers. And, gives the IT ops team visibility to improve customer experience on their website.

In addition to being a SIEM for situational awareness, Splunk has been increasingly viewed as the trusted security intelligence platform for breach response. This past quarter, a high-profile government agency and a well-known university were both breached. And, subsequently, purchased Splunk to beef up their security and breach response.

The high note for security in Q2 was our acquisition of Caspida, a leading innovator in machine learning and data-driven security -- data science-driven behavior analytics. It signifies our commitment to invest in exhilarating innovation and expanding our analytics-driven security offering. Customers can benefit from Caspida's machine learning solution to detect advanced threats from external attackers and malicious insiders.

Recent breaches have shown us the significance of identity and user credentials as an attack surface. And, our first combined solution will focus on user and entity behavioral analytics to help our customers with this critical security need. We're very excited to welcome this talented team, and are working hard towards unveiling our plans for the integrated Splunk and Caspida solutions at our upcoming User Conference in Las Vegas.

We feel privileged to be at the forefront of leading the industry transformation towards next generation, analytics-driven security. As 451 Research noted, this emerging techniques are fundamentally reshaping the nature of security analytics, and are moving toward defining an architecture that goes well beyond SIEM.

For the third straight year, Splunk was named a leader in Gartner's Magic Quadrant for security information and event management. In fact, Splunk was the only vendor to improve its completeness of vision in their report.

We could not ask for a better timing, and showcase, than this year's Black Hat USA, which took place early August. In addition to record visitors at Splunk's booth, our session on behavioral intuition detection had over 1,000 attendees. Although Black Hat's network operations center is hidden in a dark room, Splunk was front and center, powering the NOC that was described as, quote, the nerve center for one of the most hostile technology environments on the planet, end quote.

Splunk's analytics and visualizations help to keep that advanced network secured and operational. I am proud of the momentum we have in the market, and the results we have delivered in the security business. And, look forward to continuing to innovate and expand our security solutions to help our customers.

Now, back to Godfrey.

Thanks, Doug, Marc and Haiyan.

I'd have to say that I'm really proud of the Splunk Exec Team. Our core development teams keep cranking out with impressive functionality that shows in our net promoter score of 50, almost unheard of in enterprise software. The market groups are defining strategy, product direction and building an enviable ecosystem for their solutions.

Our Cloud business is accelerating, based on clear strategy and maniacal operational focus. And our superb Field organization just keeps getting stronger, and even better at delivering customer success.

I hope to see you at comp next month, where we'll raise the curtain on our product releases, enjoy a wide range of killer presentations by our customers and host for you, the financial community, and interactive panel with our Exec Team. It's going to be a great show and I can't wait to get together with you there. Again, thanks to all of our customers and partners, and thanks to everyone who works at Splunk, for another great quarter.

Now, I'll turn the call over to CFO, Dave Conte.

Thanks, Godfrey. Good afternoon, everyone. Thanks for joining the call.

Q2 was another strong quarter. And, we're pleased with our first-half performance and certainly excited about our outlook for the remainder of the year. Second-quarter revenues were $148.3 million, a 46% increase over Q2 last year. License revenues grew 42%, year over year, totaling $88 million. In Q2, and now for 13 out of 14 quarters as a public company, more than 70% of our license bookings came from existing customers, in the form of up-sells for additional capacity and expansions for new use stations.

Also, we booked more orders in Q2 than in any prior quarter in our history. We recorded 327 orders greater than $100,000. As Godfrey mentioned, we now have more than 10,000 customers, globally.

On prior calls, I've mentioned that the ratable mix of bookings continues to vary substantially, quarter to quarter. As a refresher, the contributors to that ratable mix are: term-license contracts, Splunk Cloud and certain EAA's.

Let's talk about EAA's for second, just a few reminders. EAA's are ratable because they are either a standalone term license, or include a term-license component. These contracts are typically three years in duration. And, in many cases, only the first year is immediately billable.

Subsequent years of the contract are usually billable on an annual basis, so you're not going to see those extra years on the face of the financial statements. To date, these unbilled amounts have not been significant to the financials overall.

Now, the mix for the quarter was 41%, which is on the high end of our annual range. We've experienced and we've expressed that, to a substantially degree, the ratable mix will swing from quarter to quarter. And, it generally follows seasonal patterns. As a result, we'll take a longer range view of the mix, given its unpredictable nature.

For now, we maintain our current full-year guidance of 30% to 40%, though we're likely to end the year at the top end of that range, based on first-half results. We're going to keep updating you guys as we gain more insight, in terms of how that mix is trending.

Now, as Marc mentioned earlier, we're pleased with our Cloud momentum. Both existing and new customers are utilizing Cloud services for varied use cases and hybrid deployments. As it relates to the impact of Cloud on our financials, recall that Cloud revenue is captured entirely in the services line on the P&L, and the associated costs are reflected in the cost of services. Importantly, there are no Cloud-related revenues allocated to the license line, even though most of this revenue relates to the use of our software.

Eventually, when Cloud revenues become a significant component of total revenues, we'll report it separately, much like you are accustomed to seeing with peer assessed models. As we've said, we expect the growth in our Cloud business to continue to impact both the composition of revenues between license and services, and the associated gross margins. But, more on margins in a minute. Now, back to the results.

In Q2, international operations represented approximately 22% of total revenues, consistent with previous levels. Our education and professional services represented 7% of revenues in Q2, in the range of prior and expected levels of between 5% and 10%. Remember, since we generally recognize revenues on services when they are delivered and billed, services bookings typically do not flow to the balance sheet as deferred revenue.

With respect to margins, which are all non-GAAP, Q2 overall gross margin was 88%, unchanged from Q1. And, as expected, starting to show the impact from our ramping Cloud business. Operating income was $4.8 million, representing a positive margin of approximately 3%.

Q2 net income was $4.1 million. And, EPS was $0.03 per share, based on a fully diluted share count of 132 million shares. Cash flow from operations was $13.6 million, and free cash flow was $10.8 million. We ended the quarter with over $900 million in total cash and investments, which reflects the net cash paid of $143 million for the Metafor and Caspida acquisitions.

Now, looking forward to the second half of the year. We expect Q3 total revenues of between $158 million and $160 million, with a 1% to 2% positive non-GAAP operating margin. With our first-half performance and Q3 outlook, we now expect full-year revenue to range between $628 million and $632 million, up from our prior guidance of $610 million to $614 million. Since we denominate revenue globally in US dollars, we do not have foreign exchange exposure on the revenue line.

As we continue to increase our investments in market groups, product teams, the Field and Splunk Cloud, we expect to generate positive non-GAAP operating margins of between 2% and 3% for the full year, consistent with last year's levels and prior guidance. Note that are our op margin target incorporates the expense run rates of both the Metafor and Caspida Acquisitions.

I'll share that our margin targets include the impact of a gradual 1% to 2% increase in cost of services, from growing our Cloud business. It also includes higher professional services costs, delivered around our market groups solutions.

As a housekeeping item, since we expect to be profitable on a non-GAAP basis for the balance of the year, for your EPS calculations, you should use fully diluted share counts of approximately 134 million in Q3, and 137 million shares in Q4. We remain committed to running the business on a positive operating cash flow basis, and continue to expect that full-year operating cash flow will be approximately 20% of total revenues, with the quarterly levels following the trend we've seen over the past several years.

As I've mentioned, FY16 is a higher than typical CapEx year, as we expect the bulk of our San Francisco HQ buildout costs will be incurred this year. When combined with global facility expansions to accommodate our growing employee base, we expect approximately $50 million in total CapEx this year. First half CapEx totaled $10 million, and expect the remaining $40 million will come in the back half of the year, mostly in Q4.

In closing, our team continues to execute on our mission to deliver exceptional value to our customers. And, we are committed to continuing investments in our products, solutions and overall global reach. Q2 ended a solid first half, and, I'm enthusiastic about our outlook for the remainder of FY16.

With that, let's open it up for questions.

(Operator Instructions)

Brent Thill, UBS.

Thank you. Good afternoon.

Dave, the term mix continues to come in above your guide range. And, I realize you ended with a comment that you expect to end closer to the high end of your range that you gave at 30% to 40%. But I'm curious, just in terms of the economics, of what you're seeing in most contracts, versus the perpetual world? How you look at the trade-off? And, how you think about the long-term value to those deals, versus what you're seeing on the perpetual side?

Sure. Brent, thanks for the question.

As you know, the predictability in any 90-day cycle, of what that mix is going to be, has been a fun item to try to forecast. And, that's from three years ago when we first went public.

I think what's important about the lifetime value of those arrangements, when we think about mix, is how we're enabling customers to adopt a product. That's our objective.

How do we structure arrangements that give the customer the predictability around their investment in Splunk, and the freedom to deploy broadly across the enterprise? So, in terms of lifetime value, the mathematics around it -- a three year, maybe a four year term contract, is equivalent to a standard perpetual license. But when looking at the cohort of a customer, and the adoption trends, we think it's obviously far more valuable in terms of overall LTV of those customers.

Great. And, a quick follow-up for Godfrey and Haiyan on the security side.

You had a really impressive run there. And I'm just curious, when you look at the halo impact that your security business is now having on other aspects of the Splunk, go-to-market and new products. What are you seeing in terms of landing that security customer, and how quickly you are starting to see that now spread into other areas of governance, risk compliance?

Well, I just have an overall comment on that, Brent, which is if you had asked me that question three or four years ago, I always coached our field organization to go into IT operations first. Because, you can spread more quickly from there. And, I was always a little bit reserved around going into security department first, with a customer because, I was always a little fearful that we'd get de-positioned as a security, like a SIEM, which would not be not great for us.

And, I think that market has changed so much in the last three years that the security department is often, now, the keeper of the Splunk index. But the difference is, for the first time, they are serving as a steward for a lot of machine data across the organization. So I think it's as easy for us now to enter security, and then expand across to app dev or IT operations or business analytics, as it was three or four years ago, for us to enter in through IT ops or apps, and then spread to the security department.

I think that if you look at all of our EAA's, and you look at our large customer orders, all of them are multiple use case. Almost every single one of them is because Splunk has become a data platform and we're being used across multiple departments, multiple use cases. So, I think it's changed a lot in the last two or three years, all for the better for our customers and us.

Very well said.

Thanks, Brent.

Keith Weiss, Morgan Stanley.

First of all, guys, very nice quarter. Maybe following in on that vein.

When we think about the recent acquisitions, the Caspida and the Metafor, are these additional functionalities that's going to be sold as, perhaps, a separate application, is it a separate paid for functionality on a going forward basis? Or, does this just become part-and-parcel of the strength of the underlying platform? And on a related note, as we think about that back half guidance, is there any revenue contribution attributed to those acquisitions?

Okay. So, multi-part question, multi-speaker answer.

I'll take the Metafor piece, which is to say that in that case, that's really more like a technology acquisition that you are likely to see incorporated into things like our IT service intelligence solution, as opposed to a standalone app for example, but time will tell. We have a lot of -- there's some very robust technology there, that we think will be very helpful to us in IT operations.

Caspida is a little bit different than that, so Haiyan, I'll hand you the Caspida peace.

Alright. Caspida has served in this fast moving market called behavior analytics, especially focusing on users. And, we anticipate that's going to be additional capabilities. We continue to build and integrate. And, we'll continue to offer it as a standalone product, as well as giving us options to offer bundles and more choices for the customer.

In terms of revenue, we are in a very early stage and we're running early assets program. As I mentioned, we'll be unveiling more of the details of this integrated plan at .comp. So, looking forward to talking to you guys there.

And hey, Keith. This is Dave.

Specifically in terms of our model and our Outlook, as Haiyan mentioned, we're really focused on ensuring that the technology, and how we bundle that in with our overall security solution, is paired appropriately with our existing ES application. Our model assumes no revenue contribution, because we're really not planning to have a major rollout of that solution until towards the end of the year. So, we don't have any revenue built in today.

Got it. And, if I could just sneak one more clarification in.

I think Doug mentioned adding more than 100 global field positions during the quarter. I'm assuming that's not all quota-carrying reps. Can you give us a little bit more color on what those global field positions were? And maybe, can you give us the number of quota-carrying reps exiting the quarter?

Sure, Keith. We have been a little bit more focused, going into this year, at making sure that we gain critical mass in different markets, and that we have a well-balanced hiring approach. So, we've concentrated hiring in a handful of customers, where we've seen critical mass in the US and public sector really work to our advantage. We're mirroring that model.

But, we're also ensuring that were maintaining the right manager-to-rep ratio. So, they can actually do their job of growing and developing the reps effectively. We've got the right presales ratios. It's a great technical sale.

And we've seen, consistently, that having the technical side of the house walk the halls with the reps, greatly increases their education and knowledge of Splunk and helps spread those use cases. And, we've been talking about some of these specialized resources that carry distinct security capability, or IT operations capability, or app dev or business analytics rather. And, we're also adding that specialization on both sales and presales around the globe so that we can increase our win rates, or maintain our win rates, within those categories.

Hey, Keith. It's Dave. Let me pile on a little bit.

I'm really excited to see adding that type -- over 100 resources in the field organizations, all around the initiatives that Doug mentioned. As you guys know, we've been talking now over a year about building out our capabilities around our core markets. High end's doing a terrific job in security as you know, Rick Fitz.

And, we're excited about the intelligent app that we're going to be talking about at .comp. So, these investments have been really important, in terms of how we deliver value to the customer. So, seeing that type of momentum, in terms of our ability to get coverage and reach around all these initiatives in field organization, is great. Over 100 in a single quarter.

The back half of your question is how many are quota carriers. So, we ended the quarter with 362 quota carriers. That is up about 36%, 37% year-over-year. 30 plus incremental quota carries since last quarter.

Excellent. Great job, guys.

Thanks, Keith.

Walter Pritchard, Citi.

Hi. Thanks. A question on my end around the drivers of the Cloud business.

I'm wondering if you could help us understand how many of these customers are born in the Cloud? Or, customers that maybe wouldn't have looked at your product two years ago, or three years ago, when you didn't have the Cloud offering? And then, of the customers that are more your traditional base, what's causing them to consider the Cloud offering, versus just consuming the capacity that they've consumed for a while?

Hey, Walter. This is Marc. Thanks for the question.

Obviously, we're extremely excited with the demand we're seeing in the marketplace for Cloud solutions, and thrilled with our growth to date. It's really a solution, and a delivery option, that's appealing to customers of all shapes and sizes. So, we have very small customers, small departments that are using Cloud as an entryway into Splunk and their first experience. At the same time, we've got customers that are sending us at multiple terabytes per day.

And, I think there are really two main drivers around this. So, the first is just where do you want to focus your time, effort, energy and attention? On running Splunk or, on using Splunk? So, that's one of the drivers.

And then, the other one is where is the source of the data? So, for a lot of workloads that are running in the Cloud, there is a lack of interest in back hauling all that data to on-premise Splunk deplyoment. It's already in the Cloud, they've already rationalized that. So, it really makes sense to send it to a Splunk Cloud.

But, with the additional options that Splunk Cloud presents for customers, we definitely see an expanding, addressable market because of that. And, of course, we offer a hybrid solution for our customers, so that they can run Splunk Enterprise on-prem and Splunk Cloud. And, we're actually the only solution in the marketplace that gives customers that true hybrid experience, where they can search seamlessly across data stored on-prem and in the Cloud. And to the user, they can be able to get that unified experience.

Okay. Thank you. Next question, please.

Brian White, Cantor Fitzgerald.

Hi guys. I'm wondering if we could talk just a little bit about the orders over $100,000. I went back in my model, it looks like it's the strongest sequential growth we've ever seen for July quarter, for these big orders. So, number one, what's the dynamic you see out in the field?

And number two, maybe talk about price changes in the July quarter, and what was the ASP that we saw? I think, previously, you talked $40,000 to $50,000. What are we looking at this quarter? Thanks.

So, on the six- and seven-figure orders, I think we're just doing, as you saw with the hiring, we talked through with the focus and expansion we're driving on a rapid and overall feel basis. We're just doing an increasingly better job, I think. Finding opportunities, but even more importantly, adding in the customer success or really driving these opportunities, driving Splunk across multiple different departments and use cases. So that we can drive ourselves into these organizations, as a data fabric, a data platform and those, by nature, drive larger deals.

So it's -- we've got the wonderful challenge of making sure we have enough reps to cover the Brownfield accounts, and that we're still paying attention to Greenfield. And, as we're driving these Brownfield, you're seeing bigger orders come out. Dave, do you want to handle the ASP.

Hey, Brian. So, ASPs were at the top end of that range, at about $50,000. And, it's interesting. So you look at, to your point, a sequential increase and a year-over-year increase, in terms of large orders. And yet, ASPs are consistent.

And, back to my prepared remarks, this was our individually largest quarter, in terms of total orders overall. So, the velocity in the business is growing, not just in terms of a large orders, but all orders in total. And, that's how you get a consistent ASP, given 320 something plus six-figure transactions.

Okay. And just as a follow-up, any update on Hunk?

As far as market dynamics, we're continuing to see more interest in Hunk. But, it's limited by the amount of production, the HDFS instances we see out there.

Yes.

So, we're slowly growing. And, I think we'll continue to be a little bit held back by how industrial strength and production focused are these HDFS initiatives.

Okay. Great. Great job. Thank you.

Thanks, Brian.

Matt Hedberg, RBC Capital Markets.

Sorry about that. Congrats from me as well. Thanks again for squeezing me in here.

I know you guys have said in the past, security use cases could make up between 35% and 40% of some of your deals. We had a reseller survey, it looks like it could be as high as maybe 50% next year. I guess with the acquisitions that you're doing here, does that level of activity seem reasonable to you guys?

Hey, Matt. It's Dave.

So, as you know, security maybe 2 plus years ago, was 20%, 25% of the business. And, at the end of last year, it trued up to being not quite 50%, but over 40%. Q2 was about 40% of the total business, how that massages over time, the challenge for any individual market group is the other market groups are doing really well also. So, our core markets of ITOA, now over 50% of the business, is looking great.

I'm sure [SnayHall] who has business analytics, will have something to say about it once he gets some more tenure under his belt. But, I wouldn't say it's unreasonable, but it really will fluctuate quarter-to-quarter, and this is important. When you look at the composition of our transactions, some of our more mature customers who tend to do the larger orders, can fling that percentage on a quarterly basis. From an annual trend, I think it's still appropriate to think about security as the 35% to 45% of the business, until we see something change in terms of the analytics space.

I hate to pile on an answer but I will here. Which is, in the six-figure orders -- the five-figure and the low six-figure orders tend to be easier to track, because they're often a single use case.

Most of our large six-figure, and almost every seven-figure order, is because a customer is using Splunk as a data platform. And, they are using it across multiple departments and use cases. And then, you get into an allocation game.

So, I don't know how precise this market group number will be, as we continue to move into a platform. And, we'll just have to try to give you the best color we have, based on going through the customer information and trying our best to sort it out. But, part of being a platform is that you get multiple use cases with all these big orders.

That's helpful. And then, as a follow-up to that, you guys obviously have great partnerships, Palo Alto in particular. It seems like there are a number of nice deals through that partner.

Is there a risk that you guys could start to incorporate additional features that could eventually start to compete with some of these partners? Or, is this still of the mindset that it's complementary to some of those existing relationships?

I don't think there's much overlap, and I don't see any on the near horizon. Do you, Haiyan?

I think it's a great question. In security, there's a lot of overlapping in terms of the words people use.

But, in terms of the particular problems, the angle we're solving problems, it's just like Godfrey was saying, I don't think there's any overlap, per se. So, we continue to have great partnerships and, for us, Splunk will be as successful as the ecosystem we serve. And, ecosystem that customers use to put up their security defenses.

There's just not enough marketing words to go around. That's all.

Thanks a lot, guys. Great quarter.

Thanks, Matt.

Mark Murphy, JPMorgan.

Yes. Thank you. I'll add my congratulations.

Godfrey, I wanted to ask you, as you build towards the seasonally strong fiscal Q4, we looked back at past years and you've produced approximately 60% sequential growth in Billings. And, I know that the numbers are getting larger and that might not always happen. But, we know that you build pipeline towards that all year long.

So, just given some of the recent gyrations in the equity markets, I was curious, what is your sense of pipeline build? Are customers calm and thinking rationally? And maybe, how do you feel about the set up for year-end budget flush activity?

Yes. The enterprise software is enterprise software. So, customers are well-trained to try to use end-of-year to their advantage. And so, I don't know that Splunk is any different than any other company in that regard.

I don't know that we'll see impact of equity markets for another quarter or two. Because what, if any, impact all this equity market gyration will have doesn't show up on a day-to-day basis. It would really be more about, does it impact a company's budget for next year? Do they change their Outlook for next year?

But, I don't sense that the market has had much impact over the last week, the last 30 minutes. It's really hard to sort that out. And our guidance, as we've constructed it for Q3 and Q4, takes that into consideration.

Thank you. And as a follow-up, Godfrey. I was looking on Splunkbase, and the number of apps by vendor. There are 151 for Microsoft, 29 for Cisco, 13 for Oracle.

I'm just wondering, why do think that it is so heavily skewed towards Microsoft? Is Microsoft that disproportionate in terms of the critical systems that are producing all this high-value machine data? Or, do you think the others are just temporarily underrepresented in there, and that there likely to close that gap over time?

No, I would say it's because Microsoft tends to be a little bit more -- it's closer to the operating system level. You almost have to compare Microsoft and our apps on Splunkbase to Unix, as opposed to comparing it to Cisco, for example. And, there's just so many different utilities.

They certainly don't rise to the description of a solution, or a full app. They might be more of a connector, or a plug-in, in description. So, the words are a little bit hard to -- like there aren't enough words to go around for that either. And, we try to oversimplify it.

But I would say that, in the case of Cisco, there are enough different security environments, and enough different products in the Cisco world, that almost all of the apps applied to a product or technology that's distinct in the Microsoft world. There is sometimes three or four of them that customers have published, that solve the same problem a slightly different way.

So, it's a little bit -- I just wouldn't over-analyze it. It's not something we spend any time on. Let's put it that way.

Thank you very much.

Thanks, Mark.

Phil Winslow, Credit Suisse.

Hey, it's Joanna Kane. I came in on for Phil. Thanks for taking my question.

I was just wondering, with this integrated solution with Caspida, from a competitive standpoint, who you guys are going to be going up against or displacing? And, if you are displacing a Generation 1 SIEM vendor, do you think Splunk is also seeing a net broader deployment, inside of these customers, versus the Generation 1 SIEM vendor?

Alright, I'll take that. So, Caspida brings behavior analytics into our already very much analytics driven and centric solution, to security.

So, we have seen great momentum in adoption of the new approach. We have seen great momentum in replacing, like you said, the previous generation solutions around SIEM. And we also, as I mentioned in the prepared remarks, people are increasingly looking to us to provide the best solution around breach response.

So, definitely an expanded use case, beyond SIEM. And, we see very good traction in replacing some of the old generation solutions that were there.

And while you're on the horn, we'd like to know if you can throw a little dirt about Phil on the horn, since he's not on the call.

Thanks, guys.

Good call.

Michael Turits, Raymond James.

Hey, guys. This is Michael Turits.

A question on EAAs, anything more you can tell us about the rate of adoption, whether it's getting material, and what the use case has been for EAAs? And I've got a follow-up.

Sure, Michael. So, as we continuously talk about 70% of our revenue, roughly, comes from existing accounts. And, I think that in the wiseness of Dave and Godfrey years ago, of calling this enterprise adoption agreement is the key.

We've seen growth within these accounts, to try and treat Splunk as a platform. And, the enterprise adoption agreements of various flavors are helping to drive that.

They wrap in things like professional services, in some instances. Splunk advisory engineers, our customer-success oriented folks, education credits, headroom that the account can grow into. And, I do think that they are an important contributor to that 300 plus, six- and seven-figure deal count that we saw this quarter.

It's just anything that we can do to make it easier for our customers to learn Splunk, get more data into Splunk, see the value of the additional correlations and use cases as they do that. It's great for the customer. And I think obviously, ultimately, long-term, really good for Splunk, too.

Hey, Michael, it's Conte. I think in terms of quantifying how many EAAs are we doing, the absolute number isn't as relevant, I think. It's important that we have the program, and the vehicle, so that customers can actually get to standardization.

So, what we are seeing that ultimately bridges from the initial new customer using Splunk over the lifecycle and the maturity of their deployments, to becoming an EAA customer, is the velocity around multiple use cases in the same account. And, I think that's part-and-parcel to the previously mentioned metric, that again, over 70% of the business is the install base.

That doesn't mean 70% or more of the bookings are EAA's. That's customers deploying multiple use cases across their departments. And now, paired with hybrid search capabilities in the Cloud.

So, the combination of on-prem plus Cloud deployments, plus multiple use cases across multiple departments. That's what we're seeing, I think, quite frequently in the customer base. Ultimately, those customers will become EAAs in our construct, but they're not there today.

Got it. And then, my follow-up question was around the issue of the mix, the shift towards ratable, and the impact on growth. Obviously, we've all tried to do calculations on it. Anything else that you can help us with this quarter?

46% revenue and 42% billings growth, very strong. But, we all suspect that something, the quote run rate or real rate is a bit higher. Anything that helps us there?

Well, I tried to add some clarity. We measure the mix as a percentage of our gross bookings. The calculations that we can all do off the face of the financial statements are, effectively, the derived billings number.

And, as I mentioned in prepared remarks, we do have a component of contract value that's unbilled. It's not significant in the context of the overall financials, that I'd be disclosing it. But it would, obviously, when included, uptick the growth rate some.

But, it's not so differentiating that I would say, holy smokes, the 46% growth rate isn't good enough. And, you guys should understand that there's this whole other basket of growth.

But, as we see more and more, multi-year contracts, and the building characteristics of those and, if we think that there is a component that's lacking, that you are not getting clear visibility in terms of assessing our performance, then we'll obviously include that. But I think, as reported, I think it demonstrates the strength of the quarter and the momentum we have in the business.

Okay. Great. Thanks very much.

Thanks, Michael.

Katherine Egbert, Piper Jaffray.

Hi, thanks. You mentioned a couple times, on the call, about win rates. Can you just give us an update on the competition, and how the pricing is going? Thanks.

Yes. We remain in an enviable position on win rates. I just sat through a series of QVRs, as would normally happen the first month of a new quarter. And, one of the things we review is how we're doing against competition.

And, that Splunk as a data platform approach that we have, it still seems to be pretty gosh darn differentiated. We had a couple of nice windbacks, or takeaways, from competitors. Some open-source competitors, some smaller Cloud or other-based competitors.

And, what I just keep seeing over and over is customers, no matter what they experiment with, come back to Splunk as the most complete solution that drives the lowest total cost of ownership for them. And I think, more importantly, gets production-worthy high-value visibility around this complex data equation, quickest for them. It's just been fun to watch.

Okay. Thanks, Dave. And then, a couple quick financial questions.

You are now solidly profitable, in terms of operating margin. It looks like you'll be that way for the rest of the year. Will you stay that way you think into FY17?

Yes. Hey, Katherine.

Obviously we expect, this year, FY16s margin to be consistent with the prior year. And, the rate at which we're investing on an annual basis, I would not expect to deviate significantly from that two-year trend. Might that be a couple hundred basis points up, or a couple hundred basis points down, as we manage our investments across all these initiatives? And, when we get to the end of the year and we look at our priorities, and we set our internal objectives, that we then will share with you guys. We'll update you, for sure.

But in terms of the position that we're in, in terms of the maturity of our market and our penetration, in terms of the size of the TAM, we're really focused on continuing to invest. Because, we see just a tremendous amount of growth ahead. So, making sure that we go capture all those customer use cases and, continue to delight them with our products and reach them with our field organization, and elevate our value with solutions, is critical. And, of course, that requires investment.

So, again, I would expect maybe a couple hundred basis points of deviation. But, I'll update you when we get to the end of the year.

Okay. And then, just quickly, did the acquisitions add any revenue this quarter?

No.

Okay. Thanks. Good job.

Thanks, Katherine.

Kash Rangan, Bank of America Merrill Lynch.

Hey, I'll add my hunk of congratulations. A couple of questions with respect to the successful [on the padness] one year opted to the point where customers like it so much, that it starts to get expensive. And then you came back with the EAAs and Cloud.

To what extent is the, oh I love it but it's a little expensive, is still prevalent in your sales cycles? Has to come down, stable? And secondly, when you're business makes a shifting towards more subscription, how are you measuring sales productivity? And, what is the trend there?

And third and final, my favorite question for Dave Conte, you said 40% of gross bookings subscription. But I would assume that, given that roughly half your business is off the income statement. On the balance sheet, off the balance sheet. Why is your growth rate not at least 2 times of your reported growth rate? Thank you.

Thank you, Kash. Three good questions.

Doug, why don't you answer why our growth rate's not double?

Yes, I'll start with the growth rate and let you answer competitive and the pricing.

So, I do think that the EAA discussion options, and especially the unlimited EAA, have helped a bit as far as people's perception of a variable pricing metric, that they perceive they don't have full control over, around the per gigabytes of data adjusted. But, what I'm seeing as a more notable trend within more of the bigger companies that have, now, got their minds more wrapped around any big data solution is, they're understanding the total cost of driving these types of solutions in their company.

And, no matter what we charge for our software, whether we give it away or kept current price, we were 10%, 15% of the total investment necessary on compute, network, storage, manpower around that. And, why I just see this flip that's been really consistent Let me go try something else, and then come back to Splunk. It's great product characteristics, great time to value.

But, ultimately, they realize, you guys are significantly cheaper because that huge boat that follows you, and follows anyone that's going to be in this big data arena, is so much smaller and so much more efficient. And then, the manpower against it is significantly more efficient. So, I think that our competitive differentiation will continue to be really, really quick time to value, because of our integrated approach across the multiple aspects of our platform, and the differentiation of our technology.

And, Kash, it's Dave. As we have discussed in prior periods, I do agree with you that if you look at total gross bookings, the growth rate would be higher than what you see derived from the financial statements. But, I'm not necessarily agreeing with the map that you have, in terms of the rate that growth would be, if you include all the contract value.

So I guess that the booking is a one-year booking, right? But, the breakeven point for a subscription, versus license, is more like a two year. So, if you are to convert that into a pro forma basis, my thinking is that the growth rate is not just little bit above, but a lot above. Conceptually, that's what I was steering towards.

Sure. Now remember, though, that a typical large order that has a term component is three year in duration. Now, not all of that contract value is on the financial statements, as I mentioned in the prepared remarks.

And, in the one-year variety, we're not measuring any renewal stream that we expect to receive. We're not doing any pro forma calculations that would take an annual contract value, and convert it into a total contract value, even though -- we're not doing that math in the implied growth rate.

Yes. I'm doing that, and that's why I'm getting a much higher growth rate. It's all good. Thank you.

Yes. That's right.

And Kash, I want to take you for making Conte work a little bit on this call.

Every call.

Thanks, Kash.

Thanks, Kash.

You bet.

John Rizzuto, SunTrust.

Hi. Good afternoon, everyone.

This question is a little bit more qualitative than anything. And, it's really -- if you look at the potential for Splunk, I know you like to think that I kind of forecast it. You are only scratching the surface of how big you can be. But so, in that sense, you're really only just starting the race.

And, the metrics just keep coming up. They look great. You could be on autopilot, but clearly you're not doing that internally.

What are the things, to what you can, that you're looking at internally to make sure that your business is operating, or grabbing the opportunity in front of it, that it has? Such that, as growth rates potentially may slow, you're still solidifying your grip and your hold of the marketplace?

Good question, and I'm happy to give a very short answer to that. There are three things that I think about, on a continuing basis, to make sure that we're driving this opportunity as hard as we can.

Number one is improving the technology from top to bottom of the stack. We continue to improve the core, Splunk Enterprise and all the core platform elements, so that it can be the very best indexing engine and data analytics device known to man.

But, that also has to encompass the solutions business, hence our market groups. So, being able to add solutions and apps on top of that, like enterprise security, which has become such a force in the marketplace. Like Caspida, which we'll be next year. Like IT service intelligence, and on and on. So, making sure that we have the best whole product, regardless of what the customer's use case is, so that R&D spend is job one.

Closely following that is Cloud. Because, the next major growth area for us is to make sure that we capture everyone's business, regardless of where they want to deploy it. And, there are so many customers who have a lot of on-prem business, but also are putting new projects in the Cloud.

And, we are so uniquely positioned to help the company bridge their way from on-prem to the Cloud, because of our hybrid approach and because of the flexibility of our software, and our fast deployment times. We're just -- there's nobody in the marketplace. As Doug said, there's nobody that can deploy and deliver success as fast as we can.

And, the third is coverage. And it's all about field. It's about field expansion. And, as Doug said, it's about sales positions, technical positions, customer success. It's a highly technical world we live in.

And, you can't just put sales people on the street and be successful. You have to put a very strong technical team on the street to help the customer achieve success, and really understand these complex issues. And somehow, Splunk magically translates all these very complex data issues into very rapid deployment success.

So, now back to beginning. Core R&D plus solutions is one, Cloud is two and all types of coverage is three. And, as long as we keep doing that, I think we have a pretty good runway in front of us.

Great. And then just a follow-up to that, looking at one, you bought two companies here in anomaly detection and behavioral analytics, which -- they could be thought of as run-of-the-mill applications but that actually seems like it might be an inflection point in where you can take your technology. Particularly in terms of remediation, prescriptive, analytics, automation and detection, what do you think that sectors how important these technologies are to the next generation Splunk or are they not?

They are important. Splunk's reputation, Splunk's brand to the degree that our technology brand is built around highly flexible search, is fantastic.

But customers don't want to be limited to just search. Like if I just keep searching, I'll find the anomalies or I'll find the unusual patterns or I'll find the outliers. They want Splunk to tell them where those patterns are and to tell them where the outliers are, to be able to compare known versus new so that you don't have to do everything through a query.

So it doesn't matter whether you're talking about security, or IT operations, or business analytics, a customer transactional set of questions, any type of process analysis. You want to be able to compare new versus old or rare versus normal and those types of things. So the whole notion of machine learning, anomaly detection, and the like is core to a whole new set of applications of which insider threat and user behavior analytics are just two examples. But you have to have those core technologies in order to move from query to pattern recognition.

If I may just add one quick thing, I mentioned we are increasingly being playing the role as a nerve center. You can just think of that two acquisitions as a major boost to the brainpower that we'll bring to the customer.

Perfect. All right. Thank you.

Thanks, John.

Kirk Materne, Evercore ISI.

Yes. Thanks very much for squeezing me in, and congrats on the quarter.

Godfrey, I just wanted a quick update on what you're thinking about the opportunity to expand the ISE platform -- ISE partner opportunity on top of your data platform? I think you talked a couple times on the call about Splunk evolving into more of a data platform. Obviously a platform connotates the ability to build more and more apps on top of it. You guys have obviously build a lot of apps yourself.

Where do you guys stand in terms of bringing on new ISEs that might be approaching data from a more vertical perspective or could help you guys extend some of the use cases and build solutions around some of your underlying technology? I'm just curious where we stand on that heading into .comp next month. Thanks.

Thanks, Kirk. I'll probably I'll give you a short answer today and clump the rest of that answer to comp, because I didn't really do a lot of homework around our most recent stats there.

But part of what I've asked [Zahall] to do is to really beef up the team we have that's doing all of the developer certifications. We have all the tools. We have all the APIs and the SDKs. We have a lot of the technology bits to help a developer organization and ISV set up companies become more and more confident and capable of success on top of the Splunk engine.

Where we are a little behind on resources is actually helping them test and certify those apps to make sure that when stuff goes up on Splunkbase, it's really easy for customers to tell what like an open source submission versus something that's been tested in an enterprise environment. And I think that for the ISVs of the world, the number one thing enterprise customers ask me is, have those apps been tested and you are certain that they can work in an enterprise production environment without fail?

And that's a very different level of fit and finish that the customers are now asking us to make sure of. The organization we have that helps our developers be successful is a next area of major investment for us. And I think it'd be a little easier for us to give you a complete walk-through on that, or at least a brief walk-through on it at comp, I'll try to build it into remarks we are preparing for the investor Q&A for the panel.

But anyway, it's something that's high on my mind. I think I probably will get a little better organized answer it for comp.

Great, look forward to it. Thanks, guys.

Thanks, Kurt.

Okay. Thanks, everyone, Karen, thanks for your help today. We appreciate it.

And we are around here tonight if you have any follow-up questions. Hope you have a nice evening. Thanks everyone.

Thank you. Ladies and gentlemen, thank you for your participation in today's conference. This does conclude the program and you may now disconnect. Everyone have a good day.