Splunk Inc (SPLK) 2017 Q1 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the Splunk, Inc., first-quarter 2017 financial results conference call.

(Operator Instructions)

As a reminder, today's conference may be recorded. I would like to introduce your host for today's conference, Mr. Ken Tinsley, Corporate Treasurer and Vice President of Investor Relations. Sir, please go ahead.

Great. Thank you, Michelle, and good afternoon, everyone. With me on the call today are Splunk's CEO Doug Merritt and CFO Dave Conte. Our press release was issued after close of market today, and is posted on our website. This conference call is being broadcast live via webcast, and following the call an audio replay will be available on our website.

On this call we will be making forward-looking statements, including financial guidance and expectations for our second quarter and FY17; transactions, products, services mix, as well as the mix between perpetual and ratable transactions; investments in international operations, and expected growth in international business; planned investments, including products, services, sales, and facilities; market and use case opportunities. These statements reflect our best judgment based on factors currently known to us, and actual events or results may differ materially.

Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures which are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of GAAP and non-GAAP results is provided with the press release on our website. With that, let me turn it over to Doug.

Thank you, Ken. Hello, everyone, and welcome to the call. It is great to be talking to you about the opportunity in front of us, as I clip past my two-year anniversary at Splunk, and six months in the CEO chair. I just came back from our annual President's Club event, where we celebrated our field team's success in delivering a strong FY16. The team is energized, and as always, our customers are our number one source of inspiration.

At Club, we had the chance to officially welcome our new Chief Revenue Officer Susan St. Ledger to Splunk. I am very excited to have her join the executive team. Welcome, Susan.

We delivered a solid Q1, with $186 million in total revenue, up 48% over last year. Our success continues to come from a combination of our existing customers expanding their deployments, and from adding more than 450 new customers to the Splunk family. We see the wave of digital transformation impacting every industry and every enterprise. The amount of data being generated is exploding, and that trend will continue.

Splunk is the best solution to enable customers to easily and cost effectively collect, analyze, and get maximum value from that data. Our strategy also remains the same: To be the ubiquitous machine data fabric by investing in our data platform, creating high-value solutions that leverage our platform and building a strong ecosystem.

As part of this strategy, we will provide customers with best-in-class solutions targeting specific use cases delivered by our partners and by our market groups. In IT operations and applications development and delivery; security, compliance, and fraud; business analytics; and the Internet of Things.

Our commitment to expand our product portfolio continued in Q1. We announced the general availability of Splunk Enterprise 6.4, a new Splunk Cloud release, and the latest versions of Splunk Enterprise Security and Splunk User Behavior Analytics.

One of the many new capabilities in Enterprise 6.4 includes new interactive visualizations, an open library on Splunkbase, where customers and partners can develop and share their custom visualizations. We enhanced predictive analytics, improved query performance, and made a series of platform security and management improvements.

We also reduced the cost of historical data storage by 40% to 80%. For example, a customer that is indexing 10 terabytes per day with a data retention policy of one year can save over $4 million of storage costs over five years. If they retain their data usage or replicate data, their savings multiply further. Our customer TransUnion put it simply. Quote, the previous version of Splunk Enterprise doubled our performance, and now the new storage optimization capabilities in Splunk Enterprise 6.4 can significantly lower our storage costs, end quote.

In addition, we introduced the app for Akamai, which allows customers to monitor and analyze the real-time performance availability and security of the Akamai CDN service. Our updated -- we updated our app for ServiceNow to provide insights into incident, change, and event management processes in ServiceNow instances; and the newest release of the app for AWS, which helps customers gain end-to-end visibility across their AWS environment, including critical security, operational, and economic insights.

We also announced our free add-on for the Google Cloud Platform, which enables customers to analyze and monitor their security and reliability of their GCP services; and Microsoft Azure customers can now purchase Azure-certified Splunk Enterprise clusters in minutes through the Azure market place.

To increase developer visibility into their dev/ops and app/dev environments, we announced the availability of the Puppet Enterprise app for Splunk. Customers can now use Splunk to correlate the data from Puppet environments with metrics and events from across the app delivery chain. This reduces complexity, and improves the velocity and quality as software product releases.

We also announced that the latest release of Docker includes the Splunk logging driver, so customers can easily get data out of containers for monitoring, troubleshooting, and security insights. Our innovation continues to deliver. Congratulations to the entire products and dev teams.

On the partner front, I am pleased with our strategic alliance with Accenture. They are expanding their bench of trained Splunk practitioners, and we are collaborating on value creation and program delivery to bring new solutions to market. Accenture is leveraging Splunk as a platform to deliver applications to enhance service delivery offerings, including their intelligent automation platform for application service delivery, and their new cyber-defense platform.

Hawaiian Telcom is one of Accenture's first clients to take advantage of their intelligent application management services with Splunk. The real-time insights from Splunk enables the Hawaiian team to be more strategic and proactive on a day-to-day basis, which ultimately improves their customer service, and increases productivity.

Splunk is now an EMC select partner. EMC customers now have a simple way of purchasing EMC solutions and Splunk products, global support and services, and education. Integrating Splunk's platform with EMC solutions will enable our joint customers to maximize the value of machine-generated data. We announced our alliance with the Herjavec Group, where Splunk solutions are at the heart of their new managed security service provider offering.

Of course, we do all this for our customers, who are recognizing that the more data they put into Splunk, the more value they can realize. That is why I continue to believe that we are very early in capturing our full potential, even in our largest accounts. For example, Tesco standardized on Splunk for operational intelligence with an enterprise adoption agreement. The retailer expanded its use cases to include security by purchasing both ES and the Splunk app for PCI compliance. Tesco already drives value across its business with Splunk Enterprise, with benefits including accelerated development cycles and improved performance and customer experience on Tesco.com.

I am also really pleased with the rapid growth of Splunk Cloud, where we saw orders more than double year over year. For example, Familysearch has significantly expanded their use of Splunk to support a record increase in system traffic. This expansion will also ensure a smooth transition, as they migrate data to Amazon web services, vital transactions that Splunk Cloud already monitors. Familysearch leverages the data gathered in Splunk Cloud to monitor their AWS usage and expenses with the Splunk app for AWS. Familysearch also uses Splunk Cloud to validate the continuous delivery of its website services.

Okta expanded Splunk Cloud and ES license for HIPAA compliance for the health care market. Okta has already has been using Splunk Cloud, NES, and IT operations and security. Splunk Cloud helps Okta's IT team ensure its own integrated platform is operating at peak performance, and the security team leverages Cloud and ES for threat intelligence, including the ability to easily detect and quickly respond to security incidents.

Travel technology giant, Sabre, will replace its legacy SIM with Splunk Cloud and ES to ensure the security of their hospitality and travel network. Sabre, which provides technology to hundreds of airlines and thousands of hotels and travel agencies, chose Splunk because it's easier to manage, scales better, and can more easily understand complex data sources. Other customers choosing Splunk Cloud in Q1 include Chicago Public Schools, Zillow, Thermo Fisher Scientific, and a cooperative group in the UK.

We also continue to see momentum in our market group solutions. We had great customer wins in IT ops and app delivery, including the US Courts, who selected Splunk Enterprise as the platform for their logging service project, a nationwide initiative. This service will be provided to hundreds of US courts to help them meet the judiciary's IT security log management policy. The US Courts also expanded its license to introduce Splunk as a data platform to new departments and users in the US Courts' administrative office and their program offices. US Courts already uses Splunk ES and security.

GoodData expanded Splunk Enterprise to help support their growing global cloud services platform. Application developers, operations, and customer support teams rely on Splunk for IT operations and application delivery in GoodData's cloud-based platform for ISPs and enterprises. Other customer wins in IT ops and app delivery include Clemson University, Chipotle, and the University of Virginia.

We are seeing increased momentum for our IT service intelligence, or ITSI solution. Customers are pleased with how easy this solution is to install and configure, and how quickly they're able to improve service levels and customer satisfaction. Existing Splunk security customer World Bank Group invested in expanding their deployment, and added IT services intelligence as they modernized their enterprise monitoring offering. They anticipate increased visibility into the health of their key applications and services, as well as using ITSI to replace their legacy tools. Other customers selecting ITSI in Q1 include the City of Los Angeles Department of Health Services and the Coca-Cola Enterprises.

Our performance in customer wins in security continues to be strong, as well. One of the world's largest global financial services firms replaced its SIM with Splunk ES, choosing Splunk over several competitors. Splunk Enterprise is already the platform for IT operations at this bank, with proven value delivered across multiple teams and hundreds of users.

Leaders at the Dartmouth Hitchcock Medical Center are strategically prioritizing security in light of a series of recent targeted attacks on health care organizations. As part of this plan, Dartmouth significantly expanded its use of the Splunk platform to protect its patients and staff from cyber-attacks. It tripled the volume for Splunk Enterprise, ES, and the app for Exchange to monitor and protect additional systems in the hospital.

And Denver International Airport standardized on Splunk to strengthen its security posture. DEN is using Splunk to detect cyber-attacks and insider threats. The airport is also planning to utilize Splunk in operations and applications teams to gain greater visibility and understanding of their infrastructure. Other customer wins in security include UAB Health System, Jetstar and LGA Telecom.

We were very proud to see Splunk products and people continue to receive industry recognition. Splunk was recently named one of the best places to work in the Bay Area for the ninth consecutive year by the San Francisco Business Times. I just want to take a moment to thank our employees. I've never seen a group of people so committed to our customers, culture, and Company. I'm proud to be part of such an amazing team. In summary, it was a solid quarter and start to our FY17, thanks to all of our customers and partners, and thanks to everyone that works at Splunk. Now let me turn the call over to our esteemed CFO Dave Conte.

All right. Thanks, Doug. Good afternoon, everyone. Thanks for joining the call. Q1 was a good start to FY17, with revenues of $186 million, a 48% increase over Q1 of last year. License revenues totaled $101 million, up 41% over last year, and consistent with our expectations of license as a percentage of total revenue.

As Doug described, we remain committed to customer success and adoption of our platform and solutions. Once again, in Q1 more than 70% of our license bookings came from existing customers. We also added over 450 new customers in the quarter, and recorded 318 orders greater than $100,000.

In Q1, driven largely by the growth of our cloud business, our ratable mix was 51%. Although it's early in the year, we maintain our full-year ratable mix estimate for software bookings of between 40% and 45%. Look, we'll obviously keep you posted if our expectations change, as mix continues to vary substantially quarter to quarter.

As we discussed on the last call, we saw an uptick in license ASPs in the second half of last year, reflective of large customer adoption orders. Consistent with the seasonal nature of our business, ASPs in Q1 returned to previous levels of around $50,000, at the high end of our $40,000 to $50,000 historic range. We will continue to monitor ASPs on a full-year basis, and will let you know if there are any updates to report.

In Q1, international operations represented 26% of total revenue, consistent with previous levels, and comparable on a year-over-year basis. We plan to continue to make investments in our international business, and look forward to continued growth and global expansion.

Our education and professional services represented 9% of revenue in Q1, at the higher end of our range of 5% to 10%, and consistent with prior years from a seasonal perspective. Remember, since we generally recognize revenue on services when they're delivered and billed, services bookings typically do not flow through the balance sheet as deferred revenue.

Turning to margins and other results, which are all non-GAAP, Q1 overall gross margin was 85%, consistent with our expectations, and reflective of our growing cloud business. Operating loss was $1.4 million, representing a negative margin of about 1%. Q1 net loss was $2.6 million, and EPS was a negative $0.02 per share, based on a weighted average share count 131.5 million shares. Cash flow from operations was $36 million, while free cash flow was $32 million. And we ended the quarter with just over $1 billion in total cash and investments.

Now looking forward to the rest of the year, we expect Q2 total revenues of between $198 million and $200 million, with positive non-GAAP operating margin between 2% and 3%. With our Q1 performance and Q2 outlook, we now expect total revenues for the year to range between $892 million and $896 million, up from our prior guidance of $880 million. Remember that we denominate revenue globally in US dollars, and therefore have no foreign exchange exposure to our revenue line. As we continue our investments in market groups, product teams, the field, and Splunk Cloud, we maintain our full-year non-GAAP operating margin estimate of around 5%.

As I've said, and as we saw in Q1 results, operating margin targets include the impact of an increase in cost of services from our ramping cloud business. Additionally, we'll continue expanding our services capabilities tailored for the use cases and solutions that align with our market group focus. We have seen clear evidence that customers who utilize our services have a higher likelihood to deploy more of our software over time. Given these investments, in the medium term we expect to see overall gross margin hover around 85%, which is within our long-term target of 85% to 90%, on our way to long-term operating margin target of at least 25%.

For EPS, remember since we expect to be profitable on a non-GAAP basis for the balance of the year, for your EPS calculations you should use a fully diluted share count of approximately 136 million shares in Q2, accreting about 2 million shares per quarter thereafter.

We will continue to run the business on a positive operating cash flow basis, and continue to expect that full-year operating cash flow will be approximately 23% of our updated revenue outlook, with the quarterly levels following the trend we've seen over the past several years.

As I mentioned on our last call, FY17 will be an unusually high CapEx year for us, as we expect the bulk of our South Bay campus build-out costs to be incurred this year. When combined with global facility expansions to accommodate our growing employee base, we're planning for approximately $50 million to $60 million in total CapEx this year, weighted $15 million in the first half and $35 million to $45 million in the second. To give you a sense of recurring CapEx levels, without the South Bay project, our CapEx would be in the $16 million to $18 million range for the year.

In closing, our team continues to execute on our mission to deliver exceptional value to our customers, and we're committed to improving the customer experience through continued investments in our products, solutions, and overall global reach. We're off to a good start, and I am enthusiastic about our outlook for the remainder of FY17.

Thanks much for your time and interest. With that, we will open it up for questions.

(Operator Instructions)

Raimo Lenschow, Barclays.

Hi, thanks for taking my question. Congratulations on a great start to the year. I have two, one for Doug and one for Dave. Doug -- no, let's start with Doug, yes.

If you look at the -- we were all nervous about the what's going on in the spending environment, et cetera, and we saw profit warnings from a good few guys in Q1. Can you talk a little bit about the linearity in the quarter, and what you saw in the different regions, as well? Then I've got one follow-up.

Thanks for the question, Raimo. What we saw in Q1 was consistent with what I've seen in the quarters I have been here in the field. There's a lot of chatter that we're all hearing around the world, and a lot of nervousness that is coming through the news channels; but from our customer engagements, it was a pretty typical quarter.

We tend to be -- to have a decent chunk of the revenue coming in the last 30 to 45 days. I don't think it was unusual in any way. The deal characteristics looked relatively similar, as well.

Perfect.

Raimo, it's Dave. Particularly when we think about it from a Q1 perspective -- we look at our Q1 over Q1 and look at linearity. It was fairly typical.

Okay, perfect. A question for you, Dave. If you look at the spending this quarter, it looked like the one number that really accelerated was R&D. Can you talk a little bit about what's going on there? Sales and marketing, et cetera, was in line with what I was expecting, while R&D seems to be ticking up. What's going on there?

Nothing more than our continued focus on expanding the product portfolio. We have been brutally deliberate about our investment thesis on product market groups, which ultimately translates to products and solutions, and of course field coverage. When we look at the impact of those initiatives, there's nothing specific, other than continuing to invest and having the right people to deliver on them.

All right, perfect. Thanks, congratulations.

Thanks, Raimo. Appreciate it.

Brent Thill, UBS.

Good afternoon. Doug, can you talk a little bit about the arrival of Susan, and how her view of the go-to-market? Is she anticipating to make any changes? I know you've spent the last two years cementing the sales force, so you effectively wouldn't think there would be a lot of change. Can you maybe walk through her arrival, and how she's seeing the organization? For Dave, I had a quick follow-up.

Absolutely, Brent. Thanks for the question. There's a lot of things that we all love about Susan. One of the core ones is her repeat experience in scaling companies from $100 million to $8 billion-plus. As we've talked about for my two years here, and I'm sure well before with Godfrey, the growth rates are important to us to maintain at Splunk, and that means a lot of scale that we've got to drive.

In my first week and a half of interacting with Susan while she's been on the job, the constant framing that she has driven with all of our conversations is how do we take the goodness that we have, as we really have built a phenomenal sales machine here, not fumble the handoff in any way, which was my number one priority in my first few calls with you guys is honor what we've done and make sure we don't miss a beat on the customer revenue front; but continue to think thoughtfully and strategically about how do we prep this Company for that same continued growth that we've experienced, so we can really execute on the market opportunity that's in front of us.

Okay. Dave, on the op margin, I know you're not making much change there. We've seen pretty modest margin improvement. One of the questions we get is there a point where you feel that you've got the right investments in, you're going to start get some better scale on the bottom line?

Obviously you won't get huge scale this year, but as you look out, can you help us walk through? I know you're not giving guidance for 2018, but there's a lot of questions around the bottom line here.

Sure, yes. If you recall from the last call, I had articulated that our point of view around margin expansion certainly in the -- for FY17 and then in the medium term from there would be 100 to 200 basis points a year, with a long-term margin objective of at least 25%. The questions that I get is, well geez Dave, if I do that math then you're not going to get to your long-term target for like a decade.

The way we think about it is as a lot of these initiatives get to that tipping point where you go from lots of fixed costs to scalability and what you're adding in the variable cost component, we see the trajectory more of a hockey stick in terms of margin expansion. We'll go 100 to 200 basis points, and then say on a -- if you drew that line on a five-year trajectory, there would be a hockey stick towards the end that accelerates us to 25%.

Now, if we see dynamics as it relates to capturing the TAM that say boy, you know what, we should accelerate our investment, we will let you know. But more importantly, if we start getting that critical mass then we'll accelerate the margin expansion. But our investment portfolio, which again I try to be very explicit around our market groups, our solutions, our platform, and importantly our cloud, is a pretty broad canvas that we are putting money at work around.

Great, thanks.

Philip Winslow, Credit Suisse.

Hi, thanks guys, and congrats on a great quarter. I just want to focus on the platform side. I know you have been working on trying to penetrate dev/ops teams, and also bring on third party ISPs. As we go into this year, I wonder if you could give us an update on where that stands, and what initiatives you have in the pipeline? Then one quick follow-on to that.

Thanks, Philip. We've had platform and developers as one of our key initiatives for multiple years, and we keep chipping away at that initiative. Every quarter we get more dev/ops in the software development life cycle. Splunking wins, which I think is going to be a continued focus for us, and is part of the charter of the IT operations app/dev market group that Rick Fitz heads up. He's been doing a really nice job there. We've brought on some additional top talent underneath him to make sure we're communicating effectively across our customer base the whole life cycle that you could and should be using Splunk in and around, so you get full benefit.

As we talked about in this call, the Puppet delivery, the app for Puppet, the integration with Docker, we're a leading-edge development organization. We love where the world is going with micro-services, containers, and the high velocity of cloud application development. We are committed to our partnership with AWS, and our overall perspective in the marketplace on ensuring that we keep pushing forward solutions in the marketplace to help with that dev/ops world.

Got it. Then a follow-up question for Dave here on the gross margin side. It's great news that you talked about doubling the number of Splunk cloud customers. Obviously, that probably shows up in some of that ratable percentage at 51% this quarter.

From a gross margin perspective, I wonder if you could just provide some more color there on the 85%. How much of that is the cloud impact, and how should we think about this near and long term?

Sure. Hi, Phil. Clearly -- and I think I've -- again, I've commented on this in the past. Today, at our level of scale in terms of cloud, it's a drag on our gross margins. Now from a long-term model perspective, we actually had always -- all the way back to the IPO, we had anticipated a gross margin range between 85% and 90%, with the plan to introduce our cloud offering. We're actually executing as we would expect.

As we think about this fiscal year, I think about it as a trough year in terms of the margin profile, as that cloud business in particular gets to a level of critical mass where we start to gain operating leverage, which will flow through both the gross margin and the op margin lines.

Got it. Thanks, guys. Congrats again.

Keith Weiss, Morgan Stanley.

Great, thanks. This is Melissa Gorham calling in for Keith. I just wanted to follow up on that discussion on Splunk Cloud. You continue to note very good growth every quarter in Splunk Cloud, so I'd have to assume that it's going to be fairly meaningful for you all, at least on a billings basis. Is there any way that you could help us size -- I know you're not going to give us the exact amount, but help us size how big that business is for you today, and how we should expect the mix of enterprise versus Cloud to progress moving forward?

Hi, Melissa, it's Dave. We're not at the stage where we're going to specifically quantify the size of the Cloud business. I think part of the -- its contribution is obviously growing, and you can see it in terms of the cost line we have been talking about. But cloud revenue -- it doesn't necessarily replace license revenue, but from an accounting perspective it doesn't hit the license line.

What's interesting about its contribution is given our number of customers when we launched Cloud was probably 10,000-plus, and our up-sell rates in terms of greater than 70% of bookings coming from the install base, the opportunity for the Cloud business to grow as a percentage is challenged, because our install base of customers continue to buy more and more of our on-prem software.

But as we continue to progress through the year, we're looking for the right opportunity to give you more color around specifics on the size of the Cloud offering. As those materialize, we will of course share them with you.

Okay, great. Then one quick one on the commentary on ASPs. I know it was down quarter on quarter, and there's certainly seasonality there, and you said difficult comparables. I just want to clarify, was that largely driven from mix shift in customer contracts and seasonality, versus any sort of discounting that was happening in the quarter?

Yes, it's actually interesting. We had the significant uptick in the back half, which we had talked about. You guys know I was reluctant to declare a new range. It made sense to wait, because so many of our large transactions come in the back half of the year. In fact, last year we did I think eight -- three eight-figure transactions, all in the back half of the year.

What's interesting, though of course, is our previously expected range of $40,000 to $50,000. We're at the top end of that in a Q1, when we typically do our fewest number of large orders. We're pretty happy with where the ASPs are for now. We will see how they trend over time.

Okay, thank you.

Walter Prichard, Citigroup.

Hi, guys. This is Jim Fish calling for Walter. One question, one follow-up. Are you seeing more budget competition as you compete for budget with the likes of other next-gen vendors such as ServiceNow, New Relic, or AppDynamics?

Nothing notable. We actually, ironically, all three of those are customers of Splunk. We were -- I think what I've seen is we tend to be bought together. There's more and more go-to-market initiatives, especially within our channel and partner group, where for them to add the value they need to add, they think through how do I combine Splunk with Palo Alto; how do I combine Splunk with ServiceNow or with other offerings to make sure that I can drive a value-added package into the customer base. But I don't see -- we have such a variety of buying centers we go after right now. I don't see this zero-sum game happening at this point.

Got it. Then perhaps more for Dave. Dave, can you talk more about the dynamics that drove that 51% ratable license bookings in the quarter versus where it's been? I know, I think it was mentioned that Cloud was a big driver, but anything else in the quarter?

No, I think it's a combination, right? What has always made the predictability of our mix challenging is individual large transactions can skew the percentages. That's always the case, mostly in a seasonally smallish Q1. When you look of the composition of our transactions on what is that seasonally small number, a handful of transactions -- in this case, some Cloud transactions -- skewed the percentage upward.

Got it. Thanks guys.

Jesse Hulsing, Goldman Sachs.

Yes, thanks for taking my question. One for Doug and one for Dave. Doug, on Cloud, because you mentioned it a few times in the prepared remarks, what are the use cases that are driving these big orders? Are they security, are they IT operations-focused? Are they something else? Does it look similar to the rest of your business?

Right now it looks really similar. If I just go back and think at some of the big orders, the six- and seven-figure orders that have come through on Cloud, they're a mix between IT operations and security. This past quarter, in some of the prepared remarks, we talked about some big SIM replacement wins. I think they are immediately going to Cloud and try and get quick acceleration in this transition done effectively.

Then they're waiting to see are they going to stay in Cloud, or they going to pull that back on-prem -- which goes back to that hybrid nature that we have within Splunk, where we're completely agnostic, and it's up to the customer to figure out where their strategic direction is with their IT landscape, and we will support ensuring that single pane of glass and effective visibility, whether it's Cloud, on-prem, or a mixture of both.

Got you. Doug, I'm getting some in-bounds from investors on stock-based comp. It was up quarter over quarter as a percentage of revenue. How do you expect that to trend through the rest of the year, and what should we think about as a trend line over the next couple of years for that as a percentage of revenue?

Hi, it's Dave here. You might recall from the Analyst Day that we showed our history of how stock-based compensation had accumulated. In particular, back in 2014 we had an anomalous situation where we had our annual focal process occurred at the same time that the stock price was at a fairly high level, which we're still amortizing those expenses on a quarterly basis.

The way we think about it, ultimately, is around what's our dilution rate. Four years ago, 2012 when we went public, our dilution rate was over 10%. Last year is down to 6%. When we look forward, we think that a normalized level, regardless of how many heads we're adding to the business, should be somewhere in that 3% to 5%. I think again, that's how we measure the effectiveness of our stock plans.

In terms of the absolute dollars that are hitting the stock-based compensation expense, those will stay at a heightened level for a bit, and then they're going to start to fall. In absolute dollars and of course as revenue increases, they will fall as a percentage of revenue.

Thanks, Dave. Very helpful.

John DiFucci, Jefferies.

Thank you. I have a question for Doug and then a follow-up for Dave. Doug, the new customer count still looks respectable at 450, but it's been two years since that number has been below 500. Can you comment at all on that, especially given all together top line metrics look very strong?

Sure, John. We have talked for the past year that this new customer initiative is kind of a stair-stepped type piece, and we expect that 400 to 550 band for a while. We don't include a number of -- the initiatives that we put in place, because they're different than the Splunk Enterprise customers that we count. We've got e-commerce capabilities, where customers are coming in and during monthly purchases from us. We've got our Splunk Light product, which continues to make gain momentum. We do not pollute the compares; we keep those out. But all those, we're expecting a payoff over time.

My expectations are, and hopes are that we'll see the breakout from the band that we've been in over the course of FY17, as we have signed on more partners, as we've delivered some of these new products like Light and what we're doing with the cloud right now and the quicker transaction volumes that can occur there, and how we can reach broader customer bases because of that. Let's stay tuned and see.

John, it's Dave. You'll recall that the stair-step that Doug described, we've seen that trend go from 200 to 300 over a six-to-eight-quarter period. Then it went 300 to 400 over a six-to-eight-quarter period, then it's 400 to 500. In fact, last year's Q1 -- this time last year, we also reported over 450 new customers.

We're still on that same stair-step trajectory, but a big chunk of it, in addiction to the product initiatives that Doug just described, goes back to our coverage in the field. We have great success with our installed customers; but having the appropriate amount of resources, both our direct field coverage model as well as that channel ecosystem, those are really important investments that we need to continue to focus on so that you'll see the -- then you'll see that next tier in terms of the step-ladder up in terms of total customer acquisition.

My data, and I go back, it's 500 to 600 back to the April 2014 quarter, where it was 400? It's like some of those e-commerce customers and some of the other -- would they normally have been counted if they -- if you didn't have this new go-to-market approach? Is that what you're saying, why it's a little lower?

I don't know, 450 isn't that much lower than 500. You have more sales people now, more go-to-market resources. It just seems like it would be -- not be a little lower, maybe a little higher? That's all.

Well, John, the metric that we give is always more than. We describe it as more than. I wouldn't say it was for 450 exactly. Now I wouldn't say it was more than 500, either. It's somewhere in the middle. I think the spikes up and down has been pretty consistent seasonally, if you look at Q4 last year versus Q1 this year.

There is a pattern that we have seen and it's over a number of years. I'm not at all concerned. In fact, we're very satisfied with our customer acquisition this quarter, and with the last year. We just have a lot of things that we're working on that we think will ultimately result in reaching the next step of the ladder.

The more we're satisfied, I want to see it go up (laughter).

Yes, got it, guys. Okay. Then quickly, Dave, if I could, it's another quarter of greater-than-40% license growth. It's been over 3.5 years where you had license growth in the 40%, which obviously that's supported by continued strong traction of sales in the field. But the consistently is -- it's unprecedented, at least from what I've seen.

How much of this -- I'm trying to figure this out. How much of it is from smoothing of your financials with that ratable portion of the license just keeps on growing? I don't even know if you can answer that right now, but it's something we're going to try to figure out, because we keep getting asked that question. Is it -- is there any light you can shine on that, Dave?

If you want to look back over beginning of fiscal year deferred revenue, short-term deferred revenue and then what was the subsequent year's delivery of revenue, obviously the component of deferred revenue that license has grown over the last four or five years as our ratable mix has increased. There's definitely a correlation between absolute short-term deferred subsequent years revenue and the component of short-term deferred that is licensed that contributes to the license revenue line.

I think what's changing in our business, and it's something that we're trying to be thoughtful about, is back to the Cloud contribution. There are components of deferred now that are Cloud becoming a -- it's still a de minimus number from a disclosure perspective, but it has a direct impact on license revenue.

Again, Cloud revenue does not flow through the license line, it flows through the services line. When we think about revenue composition, and as our ratable mix continues to include a greater component of Cloud, that's going to cause a change in the profile of license revenue going forward.

Okay. Thanks a lot, guys.

Michael Turits, Raymond James.

Hi, guys. [Jerry Matsheim] for Michael. Clearly there's a large market opportunity. At the same time, the full-year guide implies roughly 30% OpEx growth. Can you give us an idea of where and how you're investing to drive incremental revenue growth? Then I have a follow-up.

Well, this is Dave. I can tell you from all of my ES/dev peers that we're not investing in it enough. Look, our priorities have always been the same, and it starts with the product. Why does it start with the product? Because that's how you drive the best customer satisfaction. We intend to continue to satisfy the demands of our customers in terms of giving them access from their data. We always start with are we making the right investments in the product?

After that, it's in the field. Do we have the right coverage so that we can go out there, articulate our value proposition, and expand our footprint in terms of installed customers and the new ones that we just spent a bunch of time talking about. Those are our priorities.

What we have added since -- over the last five years ago, four years ago when we went public, new investments that are adjacent to those fundamentals are the market groups, because having the appropriate representation and subject matter expertise around the use cases that matter most to our customers is really important. Having Haiyan Song join around security and Rick Fitz join around ITOA is absolutely critical back to prime directive, which is ensuring that we're satisfying the customer's needs.

The other element that's adjacent, of course, is how do we deliver our products and solutions, and that equates to Cloud? That's a really important investment for us, because while people want to talk a lot about the Cloud momentum, which we all recognize is critically important, customers' workloads are -- it's a binary environment. They have a lot of their data that's behind a firewall. They have a lot of their data and workload that lives in a cloud.

It's absolutely critical for us in terms of how we satisfy customers that we offer them a cloud solution, and ultimately something we're very proud of that we think is of course unique to us, and that's hybrid search across their data location. Regardless of where your data lives, you can leverage your Splunk instance to do searches and correlations.

It's really important, to answer your question, those are the pillars of our investment model: Product, coverage, specialization and subject matter expertise, and then reaching all the various delivery requirements, all back to satisfying the customer.

Okay. Then looking at the 2Q revenue guide, it appears to be seasonally weaker at the mid-point, up 7% quarter over quarter versus 11% quarter over quarter guide last year. Is there anything specific we should be aware of that would lead to a slightly weaker F2Q seasonality?

No, I wouldn't read into that.

Got it. Okay, thank you.

Mark Murphy, JPMorgan.

Yes, thank you very much for taking my question. Dave, it was nice to see the rebound in the short-term deferred revenue. I was wondering if you could just walk us through the underlying dynamic that drove that number to rebound very nicely here in Q1. I'm wondering, was it deal mix, is it a change in durations, or just some other strength in the business?

Hi, Mark. Thanks for the question. Again, the short-term number in Q4 was so highly impacted by the duration and types of transactions that we had. Again, a few eight-figure transactions obviously can significantly skew the composition or the geography between long-term and short-term deferred.

When you turn to our seasonal Q1, I think it was a more typical behavior in terms of the types of transactions we were doing versus the end of Q4. I think that comparison is -- it was more uniform this quarter, and we just had some really exciting transactions in the fourth quarter that threw it off a little bit.

Okay. Then as a follow-up, Dave, I wanted to follow up on part of Jesse's earlier question. I think part of when people are asking about the stock-based comp, I think part of what we're observing is we're wondering if the trend toward focusing more on GAAP earnings results across the whole landscape of technology companies, it was something highlighted in the Wall Street Journal. Then there's speculation that the SEC would crack down more on some of the adjusted earnings, which again would broadly affect the entire technology landscape.

I think we're curious. If all of that intensifies, is there something you would do to respond to that, perhaps pulling back a little on the new RSU issuance, or are you more thinking along the lines that the natural roll-off of the stock-based comp expense that you described, that it will essentially take care of itself?

Thanks, Mark. I do think the natural roll-off is going to mitigate the concern around SBC. Again, we are very focused on what is the appropriate total rewards package for our employees. I think I mentioned on the last call the last fiscal year, we expanded our head count about 48%, about 700 employees.

It's absolutely critical for us in terms of going and capturing that TAM. As Doug mentioned, where we are in terms of early earnings, are we in middle relief or is the closer coming in? We are on the batter's box here. We're very proud of our prior fiscal year's revenue levels. We think that's a fraction of the size of the Company that we have the opportunity to be.

Again, we focus on the absolute dilution level and where that should trend. The combination of that trending lower dilution level with the runoff of previously recorded stock-based comp is going to have the absolute number trend down, and of course the percentage is going to trend down, as well.

As it relates to the SEC, we are very attentive to ensuring that we have the right disclosures and the right compliance around any adjustments we make between GAAP and non-GAAP. I think we take it very seriously and we take great pride in ensuring consistency in our non-GAAP results.

I really think if the SEC is doing the right thing to say look, when companies are out there exercising and reporting differences between GAAP and non-GAAP, what level of consistency are they applying to those adjustments, and what should be considered recurring versus a non-recurring item that you would exclude, or a cash versus a non-cash item, like stock-based comp that you would exclude. We pay a lot of attention to the consistency of our disclosures around non-GAAP.

Great. Thank you very much, and I'll add my congrats again. Like I said, it was very nice to see the rebound and acceleration in the billings.

Yes, thank you.

Thanks, Mark, appreciate that.

Brian White, Drexel.

Yes, hi. Doug, on the big deals in the quarter -- it looked like it grew over 40% year over year, and actually accelerated. I think last quarter was just over 20%. What did you see in terms of big deals? This is generally a soft quarter, so it goes down sequentially from the January quarter, but it accelerated in growth. What did you see in the big deal market?

If I look back at my two years here, and even go back further to three or four years ago, a six-figure deal was a really compelling deal for the Company. Everyone celebrated when we did $0.5 million, or got close to $1 million. Over the past two years, we're now routinely expecting seven and even eight-figure deals.

I think that we're doing a better and better job of evangelizing the power of Splunk for multiple use cases within a Company. That tends to move the whole ball up into six-figure deals being the norm, with seven and eight being real displays of people that now have gone wall to wall with Splunk. We saw a continuation of that in Q1, with our existing 70% -- over 70% of our sales came from existing accounts, and a lot of those accounts continuing to expand usage of Splunk internally.

Okay. If you could add a little color, I saw these partnerships with a couple of the biggest storage vendors, EMC and also NetApp. NetApp made an announcement with working with Splunk. What does this tell us about either the storage market or what Splunk is doing in terms of partnerships in the storage industry? Thanks.

We've definitely had a very specific and focused strategy over the past few years on getting much more -- getting a higher level of committed name-brand partners that either distributes Splunk or bundles Splunk with their offerings. What I think that we've seen with a team that's really focused on this is more realization by vendors like Cisco, EMC, and NetApp that Splunk is a great addition to the packages they put into their accounts. It provides visibility, analytics, assurance, in the case of NetApp or EMC on the core storage solutions, or the infrastructural solutions that those guys are distributing.

But it also can be differentiating in the types of apps or visualizations or bundles that they produce, to make sure that they are keeping a competitive advantage, and probably most importantly, serving their customer needs. That's really the part that we use with these partners is are they -- [Barney] relationships are not of much value. We've got a lot of brand name and a lot of marketing momentum for the Company. We want real committed relationships in the field, where their reps ideally are both commissioned and quota-credited for bundling Splunk or including Splunk, a they're really adding value with what they're delivering to their customer base.

Okay, great. Thank you.

Kirk Materne, Evercore ISI.

Thanks very much. Doug, I want to pull on that same thread you were just talking about with your partners in terms of your signing Accenture up as a system integrator partner is, I think, a pretty big step forward for you guys, given you had to carry all the water in terms of getting Splunk out there just a few years ago. Can you talk about -- and maybe not Accenture specifically -- but Accenture, you had the relationship with Booz that you announced last year.

Can you start to get some greater leverage from a sales perspective as you have this partner network, I guess, picking up. Is that something that can start to positively impact you guys this year, or is that something that's got to take at least 12 to 18 months before we start to see some of the leverage from this broader partner channel? Thanks.

Thanks, Kirk, and thanks for noticing the Accenture piece. I was surprised we didn't get more notice of that when we actually made that announcement, because I remember before joining Splunk hearing how we're so easy to install and so much immediate value that none of those SIs ever pay attention to us.

That's been another one of those key initiatives in the partner groups is how do we get Accenture and the other major SIs around the world to understand that there is a real practice they can develop around Splunk. We might be easier to install and initially configure than some of the more complex ERP packages, but it's a very strategic offering, and they can actually build a lot of their critical initiatives around Splunk that are the high-value, high-margin initiatives.

What I'm excited about the Accenture relationship, obviously it's a great brand, love the company, great group of folks. Having them backing us from a go-to-market and SI perspective is a good positive boost. But they are wrapping us into different core offerings that they deliver to their account base, in addition to classic SI systems-integration type work. A good example of that is their application out-sourcing business, where Splunk is becoming a critical infrastructural component for those contracts already under wraps.

Hawaiian telecom is one of those examples we gave this quarter, was one of those first customers, where not only do we provide the opportunity for the customer, Hawaiian Telecom, to get better visibility into their landscape, but Accenture is lowering their cost of serving as they're delivering a capability into Hawaiian; and they have the ability to generate brand new services because of the correlations and different new offerings that can be created that Splunk is driving as the intelligence engine around that application outsourcing initiative. It's the same thing with their cyber-security initiative they're pushing, as well.

Can I just ask you one follow-up, one quick follow-up on that. When you think about IOT, you seem to be pretty uniquely positioned in that broader market. However, there is always that tension between do you want to develop the solutions yourself, or hopefully have a partner base built on top of you. When you think about that particular opportunity, are you leaning one way or the other in terms of the best way to break in or help expand that market? Thanks.

Heavily leaning towards partner. Even in with security and IT operations and app/dev where we've got a lot of strength, it's still a prominent partner lean. I think it's even harder with IOT, because the vertical and geographic specificity is so much higher. You really need domain expertise, I think, to serve those customers well.

It's going to be very difficult and an unfair ask of Splunk to have enough discrete manufacturing versus process manufacturing versus health care and hospitality. We've got to turn to the partner channel for that.

On that vein, for all of you that are tuned into the Indy 500 race this weekend, stay tuned and take a look at where Splunk might pop up there. There will be some announcements after the weekend, when we're allowed to talk about some of the benefit that we're driving in that venue.

Great. Thanks, and congrats on the quarter.

Bhavan Suri, William Blair.

Thanks, guys, and congrats. Let me add that to the list there.

Just to dive into the premium products here, you have talked a lot about some of the security stuff and obviously the core business and then other things. When you look at the UBA and some of the premium products, how are those -- how is the up-take there? Maybe a couple examples of how that's layering on to potentially drive ARPU expansion at some of the accounts that are adding into the core platform?

I think that continued progression, yes, has been so wonderful -- the enterprise security product -- to see that gain critical mass and traction. In security-led deals, it's becoming almost a standard that we include enterprise security as part of that underlying Splunk Enterprise platform engine. I think the opportunity, I'm thrilled with the user behavior analytics add-on, because it adds a whole different dimension to behaviorally based analytics and insider threat that ES by itself wouldn't be able to provide.

I think equally that IT services intelligence initiative that we announced a year ago or three quarters ago and its being driven into the marketplace. It's that same for our existing IT ops customers, we're seeing a lot of interest as we go back into them to up-level how they're defining services across our IT ops landscape, and getting effective analystic visibility on the quality of those services.

But all three of those still I would view as lower-level extensions of the core platform, with ability to deliver more specific solutions on top. They're almost enabling solutions within those market segments, going back to our push for partner involvement, and continuing to refine the platform, so it's easier and easier for third parties to develop applications and drive their own revenue within Splunk. I think that's -- in the long-term basis, that's going to be the bigger lever for us, as far as expansion of footprint and any type of ARPU enhancement.

Got it. Then one quick one for me. Obviously Splunk Light has been out for a little while. You guys commented on it now being included in the customer count, et cetera.

Do you anticipate a shift -- and obviously the small customers may not -- but as they grow or as they increase usage, do you anticipate a shift from Splunk Light to more of the enterprise platform? Could that play out at all, or are these two fairly different segments, in terms of how you're charging how the product delivers?

We actually have seen Splunk Light as an entry, leading sometimes within days or weeks, sometimes on a longer basis, to a licensed to use Splunk Enterprise. But really, the whole focus was how do we reach all segments of potential users? How do we make it easier for a one-to-five-person IT team that's going to have a very different skill set and bandwidth capability to get the same value from Splunk that a 100 or 10,000-person IT group is getting from us.

They're different segments, but they have got similar needs. It's more driving ease of use, even higher and quicker time to value; more simplicity in the product, turning off some of the configurability of bells and whistles, so that it's less complicated in the way it's delivered and consumed by those guys.

Got it. Thanks guys. Thanks for taking my questions.

Matt Hedberg, RBC Capital Markets.

Great, thanks. Congrats, guys. A followup question on the UBA prior question here. Obviously there seemed like there was a lot of momentum coming out of RSA from that particular product, a lot of buzz.

I'm curious, when you look at the competitive landscape there, competition is never easy. Do you find more white space when you're looking at security deals than say core [ITOM]?

What do you mean by more white space, as far as --?

Do you see -- the competitors in ITOM, and it's fairly well defined. Certainly in ITSM and some security aspects it is more definable. Do you see -- you are more than ITSM. Do you see the competitive dynamics -- I don't want to say easier, but do you see more of an opportunity there where you have a differentiated solution?

I get what you're saying. What I think we're seeing with UBA, it's a different -- it is a more wide-open area. It's a very -- it's a pretty unique value prop that we're driving. But it's a brand-new emerging market, where there is -- just like with any 1.0 product or early product -- there is as much education and evangelism and proving that there is value before you start to get the okay, I get the value, now I just want to do business with you. I think we've gotten to with enterprise security and the SIM market.

People now, it's taken a long time for us to be seen as a true SIM and security player. But we're now being practically included in all SIM RFPs, whether it's a green field or a placement. I think we're way behind that in something like user behavior analytics.

The market is still trying to figure out how important is it, and can a solution really provide the insights and capabilities. I expect that to change. We have seen that change in the last two or three quarters as people are starting to come up to speed; but there still a lot of evangelism.

Again, long term, our approach from our own solutions and just as importantly, a third-party partner solutions, is how do we cover as much end-to-end capability, given the complex security and compliance and fraud needs that our customers have, so that they get a single pane of glass, effective analytics, and the right visibility to make sure that we can keep all of our information and businesses safe.

You bet. That's perfect. Thanks a lot, guys.

Brent Bracelin, Pacific Crest Securities.

Thank you for taking the question. I just want to go back to the Cloud impact on gross margins. Given the momentum you're seeing, doubling, obviously we down-ticked on the services margins below 70%. How are you generally thinking about that? Is the new range 65% to 70% if we continue to double here? How should we think about Cloud gross margins?

Hi Brent, it's Dave. We think the minimum from a steady-state Cloud margin is 70%. We obviously have some miles ahead of us to get there, but that's our minimum threshold in terms of expectation.

Okay, very helpful. Last question from me is really around ITSI. We're still early days. You did talk about three examples. Coca-Cola seems like a pretty high-profile example there. Relative to your adoption, is this on track with the pace of adoption you thought it would be on, or ahead of where you thought it would be on? Help us understand the path that ITSI is on today, and the potential looking out a couple years?

I think that IT ops and app/dev team has done a fantastic job with ITSI. I'd say it's probably ahead of where we expected, but there's high expectations for the group. They have really -- they executed really well from the very beginning, making sure that we did the right co-development work with our early partners.

We had the right beta and testing and new product introduction programs so that what we were confident in the features that were delivered and we wouldn't let our customers down. There's still a lot -- it's still a very early product.

There is both a feature expansion necessary at the product; but I think just as importantly, the surrounding services and education around the product that we are expanding on concentric circle type visual, making sure that our partners understand how to implement and how to configure. Then customers come up to speed on what does it take to define a service, and how do you keep it current and effective.

But it's really been a wonderful thing to watch. I have to congratulate Rick Fitz and the entire team over and over on a thoughtful and customer-first approach for how we roll something out with the fewest hiccups possible.

Deal sizes on ITSI are comparable to what you've seen in the past on ES, as well?

That is a good question. Dave, are they a bit higher?

They typically are -- they're similar on SKUs. They're typically larger.

Slightly larger deals. Okay, very helpful. Thank you.

Thank you, and we have time for one more question from the line of Steve Ashley with Robert W Baird.

Perfect, getting under the wire. Doug, I'm going to tip my hat. You tell us to tune into the Indianapolis 500 and see what kind of benefits we're driving. That's very clever. I thought that was quite good. You can see the sales side of you there.

In terms of the security business, number one, in the past sometimes you've given us what percentage that might've been in the total? My question, my second question's on the security business. Looking for some color on how concentrated or diverse that business is in terms of use cases? Are there a handful of use cases that dominate that business, or have you seen a wide dispersion of use cases? Is there any color you can give us around that on the security side? Thanks.

Whenever we talk about the amount of revenue going to one of these market segments, every one of these calls I've always tried to caveat that, that's the initial sale of Splunk. What we expect, as we saw with a bunch of the use cases or customer examples I gave, is that because we are a schema at read, and know that data you put in has hardened, that as security is getting benefit, their colleagues in IT/ops or their colleagues or app/dev, or their line of business IT folks are trying to serve marketing or sales needs, can look over, interrogate the data that the security group may have accumulated, and see is there a benefit for them without any additional costs.

That's still one of those -- I repeat that so many times at Splunk, because after almost 30 years in the IT industry starting with a strict relational database client/server world, that still blows my mind that you can ask totally different questions of the same data and get completely different answers and different value out of it, without ever touching anything akin to an ETL stack or crafting a whole new schema and repurposing the data.

What we saw this quarter is again in the 40%-ish range of these new deals being security based. With security on the concentration, I think we've become relatively well -- people now associate Splunk with the security operations center dashboard and a SIM-like set of characteristics. From a first-sale basis, that seems to be a lot of where we are focused.

But as we all know, the security landscape is incredibly diverse, and there are so many different use cases. Security is 50,000-foot term, and very far away from the ground level of what our customers are dealing with. We will enter in one of those -- now with ES with a SOC-type application, but then dive into a whole host of more specific use cases as they try and fill up the repository of comprehensive security data.

Perfect, thank you.

Thank you. This does conclude the Q&A session for today's conference. I would like to turn the call back over to Mr. Ken Tinsley for any closing remarks.

Great. Thank you, Michelle, appreciate your help today. Thanks for everyone's participation. We're available tonight if you have any questions. Hope you have a nice Memorial Day weekend and enjoy the race on Sunday.

Ladies and gentlemen, thank you for participating in today's conference call. This does conclude the program, and you may all disconnect. Everyone have a great day.