Splunk Inc (SPLK) 2018 Q2 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the Splunk Inc. Second Quarter 2018 Financial Results Conference Call. (Operator Instructions) As a reminder, this conference call is being recorded. I would now like to introduce your host for today's conference, Mr. Ken Tinsley, Corporate Treasurer and Vice President of Investor Relations. Sir, you may begin.

Great. Thank you, Geronimo. I appreciate that, and good afternoon. With me on the call today are Splunk's CEO, Doug Merritt; and CFO, Dave Conte. Our press release was issued after close of market today and is posted on our website. This conference call is being broadcast live via webcast. And following the call, an audio replay will be available on our website.

On today's call, we will be making forward-looking statements including financial guidance and expectations for our third quarter and fiscal year 2018, market opportunity and our competitive position and planned investments, including products, services, market groups and sales.

These statements reflect our best judgment based on factors currently known to us, and the actual results and events may differ materially. Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures, which are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.

With that, let me turn it over to Doug.

Thank you, Ken. Hello, everyone, and welcome to the call. We had a solid Q2, delivering revenue of $280 million, up 32% over last year. Our success continues to come from a combination of our existing customers expanding their deployments, both on-prem and in the cloud, and from adding more than 500 new customers to the Splunk family. On last quarter's call, we talked about the change we made in EMEA and called out the strength of the leaders covering EMEA theaters. I want to congratulate them for delivering a solid performance in Q2, as our Chief Revenue Officer, Susan St. Ledger, continues to work through the robust pipeline of external and internal candidates for the EMEA-wide leader.

Our macroenvironment continues to be strong. And as we've said, we're still early on the Splunk adoption journey, even within our largest accounts, and we continue to vigorously pursue those opportunities. I look forward to a great second half of this year.

Stepping back with the move to digital, e-commerce, mobile and social, organizations are now increasingly using machine data to provide critical context to transactions they store in their databases and data warehouses. Splunk's platform is the best solution to enable customers to harness this largely unstructured data to make it -- to use real-time decisions. There's no other solution on the market today that does all that we do, and Splunk enables our customers to extract more insights from their ever-increasing amounts of data.

Our goal remains the same, which is to become the standard for machine data in every account, a ubiquitous machine data platform solving our customers' big data challenges in IT operations and application delivery and security compliance and fraud as well as business analytics and the Internet of Things. These markets are going through a shift to an analytics and machine learning-based approach, where Splunk is uniquely positioned to lead this change and deliver for our customers.

During the quarter, we saw a continued momentum in both our Splunk platform and in our premium apps: Enterprise Security or ES; user behavior analytics, or UBA; and IT Service Intelligence, or ITSI. These apps accelerate time to value for our customers, and we are driving more use case-specific solutions in our core markets.

Starting with security. We had a strong quarter in Q2 and saw many large security orders driven by what we believe is an ongoing SIEM replacement cycle at our customers, coupled with multiple security events that we all saw in the past several months. This is clear at Black Hat last month. Security departments globally are increasingly realizing the need to shift their focus to an analytics-based approach to security, an approach that Splunk has been defining and leading for years. And as I just mentioned, it's becoming more clear that we're in the middle of a SIEM replacement cycle from a traditional, structured data, legacy SIEM, to a modern analytics-based one. Splunk is helping our customers with this shift as we continue to take full advantage of this opportunity.

This past quarter, we introduced a new security solution, Splunk Insights for Ransomware, which delivers an analytics solution to help our customers manage ransomware threats. This is a great example of our ability to leverage the flexibility of the Splunk platform to quickly introduce a new solution that helps our customers deal with their critical pain point.

Similarly, an IT operations and app delivery, where we have our ITSI app, we introduced Splunk Insight for AWS Cloud Monitoring, available to customers via the AWS Marketplace. This offering delivers an analytics-based approach to cloud migration and monitoring by providing end-to-end visibility into an organization's AWS infrastructure, delivering real-time awareness of performance, health, configuration, security and spend.

Our strategy in these core markets continues to be validated in the industry. I was proud that Splunk was named by IDC as the market share leader in both the worldwide IT operations, analytics software market and the event and log management software market by IDC.

On the security side, ES won 3 industry awards: Best SIEM solution in the SC Awards Europe; Security Product of the Year in the UK's National Technology Awards; and Top SIEM Solution in the Computerworld Hong Kong Awards. Congrats to the entire team.

Now on notable wins. Cloud-based health care services company, Athena Health, who expanded its use to Splunk Enterprise and ES in Q2 as part of its fraud, compliance and workflow initiatives. You can catch our champion, Jake McAleer, speaking at our user conference next month about using Splunk for health care security.

The State of Montana expanded its Splunk Enterprise license in order to help better visualize and act on their data. 25 different Montana State agencies use Splunk for a wide range of use cases. The Federal Home Loan Bank of Chicago, a wholesale bank chartered by the U.S. Congress to improve the availability of funds to support homeownership, selected Splunk Enterprise and ITSI to enhance the correlation and visibility of information security and operational events within its environment.

IP Australia, who administers IP rights to patents and trademarks to the Australian federal government, expanded their use of Splunk Enterprise and ES and added ITSI in Q2 to improve visibility and become much more proactive in resolving IT issues.

Harvard Business School, who already uses Splunk to hunt down security threats, expanded their use of Splunk Enterprise and ES to add more data sources and provide deeper and broader visibility for their security team.

Longtime customer, Swisscom, Switzerland's leading telecom and IT company, bought Splunk Enterprise, ES and ITSI to support the company's strategy to grow their technology services revenue. Swisscom will use Splunk to monitor its services, keep them secure, increase productivity and reduce time-to-market. Splunk will also be used to drive new revenue streams by packaging up insights from Splunk and deliver them directly to customers.

Other notable customer wins in the quarter included: Arizona's Maricopa County; ABSA, part of Barclays; the University of Nebraska Lincoln; Department of Homeland Security; Panasonic Avionics; CentraCare Health System; and Regeneron Pharmaceuticals. And no list would be complete without mentioning an interesting IoT and business analytics use case. Long Beach Container Terminal is using Splunk as the eyes and ears of the terminal's operations. They use Splunk to monitor the performance of their systems, which control dozens of automated cranes and guided vehicles that are vital to moving cargo from the right place, at the right time, safely and quickly. Long Beach reduced overall system downtime and drove significant performance improvements in logistics, planning and flow of cargo throughout the terminal.

As we do each quarter, we highlight a handful of customers who standardize on Splunk as their machine data platform, singing enterprise adoption agreements or EAAs.

A few of this quarter's customers includes Carnegie Mellon University, who signed a large 3-year EAA to use Splunk Enterprise and ES for IT ops and security; and Shutterfly, the online image publishing company who purchased the Splunk EAA this quarter for Splunk Enterprise, ES and ITSI to replace and consolidate multiple tools and leverage data across all of their departments.

Our cloud business continues to grow with revenues more than doubling over last year. Our customers are leveraging the Splunk platform to analyze their data, regardless of its location, on-prem or in the cloud. A sampling of our cloud wins in this quarter include: Australian paint and coating manufacturer, Dulux Group, who's a new customer choosing Splunk Cloud and ES as its SIEM because of our ability to drive value across multiple use cases using the same data; Educational Testing Service, or ETS, the world's largest non-profit testing company, expanded their use to Splunk Cloud, which they use as their platform for IT ops and app monitoring. With Splunk, ETS achieved 70% reduction in time investigating IT incidents and 50% faster mean time to resolution; Webroot, an endpoint security and threat intelligence services provider, bought Splunk Cloud and ES to help eliminate data silos between their IT and security teams. Thanks to our partner, Red Sky, for their help in this win.

George Mason University is a new customer that chose Splunk Enterprise and ES to replace a legacy SIEM, taking advantage of Splunk's scale and hybrid deployment flexibility, utilizing a combination of on-prem and cloud footprints. Big thanks to our partners at Blackwood Associates for this win. Other cloud wins include: Royal Caribbean Cruises, Uber; and Texas Children's Hospital.

Moving on to the ecosystem, where, increasingly, Splunk is being viewed as a critical component of the IT and security landscape. Because of Splunk's ability to collect all data types and provide correlations across applications, infrastructure, mobile and wire data, we continue to see growing interest in companies partnering with Splunk. Partners who focus on particular components of the IT or security stacks end up being yet another source data for Splunk. This model allows our customers to leverage the Splunk platform to enhance serviceability of the entire environment, whether it's on-prem or in the cloud.

Recent integrations and joint solutions include Palo Alto Networks, who released the latest version of their Splunk App, which now has more than 30,000 downloads globally. We also released the next version of the Splunk add-on for Microsoft Cloud Services, which gives Splunk administrators the ability to collect events from various Microsoft cloud APIs. Splunk and Booz Allen Hamilton announced a private beta of Booz Allen's Cyber4Sight for Splunk, a new solution designed to empower security analysts and threat hunters with actionable threat intelligence.

And Accenture, who expanded their Splunk Enterprise license to bring a host of new capabilities to their own clients at scale. Splunk is being delivered through Accenture's new intelligent automation platform, Accenture myWizard, which helps customers turn data into critical insights and drive improved business outcomes.

Moving on to partner customer wins. Carnival, the world's largest cruise line, was a joint Splunk-AWS win this quarter. Carnival relies on Splunk Cloud and ES to power their security operations center. Another Splunk-AWS joint customer win was PagerDuty, who is featured in a successful joint marketing campaign this quarter highlighting their success using Splunk Cloud on AWS across a variety of use cases, from IT operations to business analytics. And our partner, Verizon Enterprise Solutions, had several strategic wins for Splunk in Q2, including 2 large federal and defense government contracts, one in the U.S. and one in Australia.

These public sector customers both significantly expanded their use of Splunk as their analytics-based security platform.

In summary, it was a solid quarter, and as always, I'm very proud of our Splunk team. We have a tremendous opportunity that's immediately in front of us. We're delivering high value to our customers, who are expanding their adoption of Splunk as their platform for machine data analytics and the machine learning, both on-prem and in the cloud.

Splunk is uniquely positioned to capitalize on this opportunity, and we're pursuing it aggressively. We are early in our journey and are investing for scale and growth. Our customer events give us energy and inspiration. Many of you have attended a SplunkLive this year, joining the more than 10,000 customers who have as well. I hope to see you at our biggest event, our user conference, or .conf, September 26 to 28 in Washington, D.C.

In addition to hearing from our customers and partners, our product teams will be making a robust set of announcements, including new releases of the Splunk platform and our solutions.

Thanks again to all of our customers and partners and thanks to everyone who works at Splunk. Now let me turn it over to our CFO, David Conte.

All right. Thanks, Doug. Good afternoon, everyone, and thanks for joining us today. Our performance in Q2 was solid with revenues of $280 million, a 32% increase over Q2 of last year. Total billings were $303 million, also up 32% over last year.

Cloud revenues totaled $21.3 million, and overall software revenues, which include license and cloud, grew 30% year-over-year. Customer success remains our #1 priority, and adoption of our platform and solutions are driving software bookings growth where more than 80% came from existing customers. We also added over 500 new customers in the quarter and we recorded 541 orders over $100,000.

In Q2, international operations represented 24% of total revenues, consistent with previous levels and comparable on a year-over-year basis. As Doug mentioned, EMEA rebounded nicely and exceeded their Q2 plan, which was great. Education and professional services represented 10% of revenue in Q2, at the higher end of our expected range of 5% to 10%.

Now turning to margins and other results, which are all non-GAAP. Q2 overall gross margin was 83%, consistent with our expectations and reflecting improving cloud gross margins. Operating income was $15 million, representing a positive margin of 5%, while Q2 net income was $11.5 million and EPS was $0.08 per share, based on a fully diluted weighted average share count of 142.9 million shares.

Now turning to cash generation and liquidity. Cash flow from operations was $23 million. Free cash flow was $20 million, and we ended the quarter with about $1.1 billion in total cash and investments.

Looking forward to the rest of the year. We expect Q3 total revenues of between $307 million and $309 million, with an 8% non-GAAP operating margin. With our first half performance and Q3 outlook, we now expect that total revenues for the full year will range between $1.21 billion and $1.215 billion, up from our prior guidance of $1.195 billion. We're raising our full year billings estimate to $1.45 billion, and we reiterate our full year cloud revenue of approximately $85 million in total.

Remember, we denominate revenue globally in U.S. dollars, and therefore, have no foreign exchange exposure to our revenue line. To execute on the large and growing TAM in front of us, we continue to make our investments in the field, product teams, market groups and, of course, Splunk Cloud.

As I've said, with these investments, we expect to see non-GAAP op margin steadily increase to our target of 12% to 14% in fiscal 2020. A significant contributor to op margin expansion will come from gross margin growth as we scale our cloud offering. Our plan is to expand cloud gross margins from about breakeven last year to 70% in fiscal 2020, and we're tracking well against this plan.

In Q2, our non-GAAP cloud gross margin reached 30%, and I expect it will remain around this level for the remainder of the year. For EPS, remember, since we expect to be profitable on a non-GAAP basis for Q3 and Q4, for your EPS calculations, you should use a fully diluted share count of approximately 144 million in Q3 and 146 million shares in Q4. We continue to generate substantial cash flows from the business and reiterate our full year operating cash flow expectation of $250 million in total.

In closing, our team continues to execute on our mission to deliver high value to our customers, and we're committed to driving the best possible customer experience through continued investments in our products, solutions, the cloud and our global reach.

Overall, we had a good first half, and I'm pleased with the outlook for the remainder of the year. Thanks very much for your time and interest. With that, we'll open it up for questions.

(Operator Instructions) Our first question comes from the line of Raimo Lenschow from Barclays.

First of all, congrats on a great quarter. That was really good to see that things came together. My question is around the European performance and the changes you guys did to -- that Susan did to the sales organization in general. Doug, can you talk to like, do you think Europe is fully settled now with that kind of Q2 is good, but there's still work to be done? And where do you see kind of Susan's work on a global scale?

Hey, Raimo, great to hear from you and thank you for the congrats. As I called out in the script and we talked about last time, we've got a strong set of second line managers over in Europe, and I think, this quarter was a good indicator. We talked about the fact that I thought we had a strong line of second line managers, and I think, this quarter is a good indicator that my faith in them and Susan's faith in them was justified. She's got a really rich pipe of candidates and, of course, is still looking for the right long-term leader, both internally and externally. And I think that our expectations are the team is very effective at doing their work day in and day out and continuing to march toward their numbers in EMEA, and we'll continue to trust, empower and lean on that team to execute.

Our next question comes from the line of Melissa Franchi of Morgan Stanley.

I guess, I would like to just dig into the cloud transition. So some of the changes that you made at the beginning of the year, I believe, were kind of centered around getting your sales force more ready to sell Splunk Cloud. I'm just wondering how that's progressing relative to your expectations? And I know that you reiterated for fiscal '18, but just wondering if you're still kind of tracking to your outlook for FY '20?

Thanks, Melissa. Yes, the core of Susan's architecture of the field this year was to balance out the allocation between named and existing accounts and non-named and net new accounts so that we could drive to the target that we gave you guys, and I have confidence we'd drive to the target we gave you guys of going from roughly 2,000 net new customer adds per year to 3,000-plus. As part of that, we've had an ongoing set of work to make sure that we have comp neutrality and the right overlay of support for our reps so that they become more and more adept at driving cloud and are able to understand when the characteristics of one of our customers, lead them to cloud so we can successful with that overall cloud initiative. I think, it was a good quarter for cloud. Dave reaffirmed our outlook for the year. We're tracking the way that we would hope and expect to, given the investments that we're making across the people, the operating, cloud operations and automation front, the product front, to drive this key initiative of ours forward.

Our next question comes from the line of Michael Turits of Raymond James.

Solid quarter. Can you maybe comment to the ratable mix this quarter, I think it was particularly strong last quarter. And are you on track for that target of 50% for the year?

Hey, Michael, it's Dave. We are tracking to our expectations for the full year. But as you know, we're giving expectations on mix annually and reporting it that way. So instead of going ratable mix, I'm giving you the cloud revenue explicitly. And right now, we're tracking well.

Okay. And then, I guess, I just got one follow-up. Obviously, you reiterate the guide on margins for the year. You did guide slightly below on margins for next quarter. Any one-timers there?

No, not really. I think, it's just the seasonality of our margin is reflected in the Q3 guide and what we expect for the full year. So I think it's pretty much on track for where we expect it to be.

Our next question comes from line of Abhey Lamba of Mizuho Securities.

Doug, you mentioned, I think, in the previous answer about the progress you're making in terms of (inaudible) new customer adds. But the metrics still is at 500 over the last few years. And I think, per based on your plan, it's supposed to accelerate towards 600 a quarter. When should we start seeing uptick in that metric? What exact steps are you taking and how should we expect it to play out?

Yes, thanks for the question. And that outlook we gave is over the 3-year time period, from FY '18 to 2020. Knowing that a big chunk of leaning in and getting net new customer coverage to actually occur is reallocating for that coverage. And that was the core of Susan's architecture in FY for this year, for this fiscal year, in a way that she laid out the sales force. In addition, our new CMO, or I guess, not so new now, 3 quarters in, Brian Goldfarb, has reoriented marketing to be a much more demand gen-focused. So the combination of a higher hiring rate and a more explicit and prescriptive focus of reps covering non-named commercial and net new accounts, plus more aggressive demand gen and top of the funnel activity from the marketing team with a tighter twist to use case specific marketing are all part of the mechanisms that we're putting in place to achieve our goal over the next 3 years to see that net new numbers start to go on a more aggressive growth curve.

Our next question comes from the line of Jesse Hulsing of Goldman Sachs.

One of the themes that we've seen in software this year and over the last few years has been a push by many software companies to shift their model from perpetual to recurring or ratable, and you guys have kind of have this ongoing shift with your term license offerings and cloud. I'm wondering if you've given more thought to more aggressively moving the needle in the direction of ratable sooner rather than later? And I guess, when you look at it, what are the puts and takes there? Is it mostly just doing what the customer would like? Or is there -- are there other considerations that you've looked at?

Good question. So the #1 priority for the company that we are fixated on and centered around is customer success. It really drives all of our key decision-making. And this comp neutrality at this point, is to really make sure that we hear the customer's voice, that we're not artificially pushing them one way or the other, either to perpetual or to ratable or cloud. But we obviously like the ratable model. We gave a forecast where we get to 75% plus subscription/ratable over the coming 3 years. And that's really based on both the voice, the customer that we see -- we all know, and it's fascinating even talking about the cloud momentum at this point in time, there's a lot of advantage for all of us in utilizing cloud when cloud makes sense. That's in the face of the reality that the vast majority of the world's data still sits behind their firewall, and a solution like ours tends to be -- is architected and tends to be deployed so that the data aggregation layers can sit closest to the data without -- while having easy search mechanism, irrespective of where that data actually is housed. But our 3-year outlook assumes that we're going to see more and more customers voting to go to cloud and to term on-prem. And we'll always optimize our commission plan to make sure that customer voice can be heard.

Hey, Jessie, it's Dave. I think, one point that Doug made, it's really important in terms of differentiating factor for us and our tradition than perhaps some other companies. And it's the realization that customers will continue to request to deploy our products, both on-prem and in the cloud. And many of the transitions we've seen has been the removal of perpetual with term but, I think, even more waiting towards pure SaaS offerings. So I think, we'll continue to have the environment, as Doug pointed out, where customers will need our software, both behind their firewall and in the cloud. And that's really an important element in terms of how our incentive plan is structured.

Yes, that's helpful. And Dave, I might have missed this, but what are you expecting for billings seasonality in the second half?

I didn't guide the billings first half, second half. I updated the full year number to $1.450 billion, both based on the results from the first half and the strength in the second quarter and our outlook for the back half of the year. So I think, you can infer the billings calc, I didn't you the balance sheet for the third quarter but, I think, you can get close to it from a quarterly basis based on the revenue guide.

Our next question comes from the line of John DiFucci of Jefferies.

But Doug, I have a sort of like a high-level question and a follow-up for Dave, and it has to do with some of the conversation around Europe. But when I look at you guys, you guys are, you almost had $1 billion in revenue last year, you'll have more than that this year. And still, it's only about 1/4 of your revenue is international. And it's been like that for about 5 years. And when I look across the universe of software, it's like it's usually around 40% in the U.S. and 60% in international. I'm just curious, is there some reason for this? I mean, your infrastructure software, it seems like there shouldn't be like regional issues with selling it. And I'm just -- or is there something I'm missing here? Or is it just a matter of you more aggressively pursuing those international opportunities? Put aside what happened last quarter in Europe, it just seems like you should have more international business at this point?

So I'm in agreement that long-term, we fully expect international to get to be a much bigger number than it is now. And the closer we get to 50-50 and above would be a normal and healthy curve. I think, part of what we are dealing with at Splunk is that cohort that Dave walks everybody through, where over the course of multiple years, 4 or 5 years, you'll see the typical customer from that class increase their data volume by 10x and their spend by 7x. And so the international markets have got kind of a dual challenge of they're further away from corporate and it's always a little bit harder to grow international, wherever that happens to be. When I was at SAP Americas, it wasn't doing that well, and Germany was kicking butt, only because they're a German company and it was harder to get the distant from German entity to do as well. But when you have a solid install base like we see in the Americas that has been with us for up to 8 or 9 years, the larger deals, it's easier to get a larger deal from that cohort that is a 1-, 2- or 3-year customer, so international got you up in the transactional velocity, laying the groundwork for the big deals. And I'm happy that they've been able to hold the ground given the increasing 6 and 7-figure deal cadence that we've been driving. And logically, a big chunk of that coming from Americas. But we absolutely are pushing on the levers and expect that to change over time and have international contribute a larger share than 23% to 25%.

Okay. That does make some sense. I wasn't thinking about that. But we'll see how that develops over time. I guess, Dave, a follow-up, I just noticed the last couple of quarters, the long-term deferred revenue as a percentage of the total deferred just sort of popped up a little bit, up from like in the low 20s to the sort of mid-20%. And I'm just curious, is that something -- I mean, you increased the guidance for the year for total revenue. You maintained cloud guidance. I know there's term license in there, too. So -- and I guess, I keep telling you, you've got to give us more, but we'll get that soon, I think, with 606. But I'm just curious, is this something -- are we also seeing renewals of those term deals in there? Is that what's really causing that?

Hey, John, yes 606 will be a lot of fun for everybody. Thanks for remembering. That's coming down the pipe. When you think about some of the customer examples that Doug articulated in our prepared remarks, there were a number of EAA type transactions. And those historically have almost exclusively been on-prem and would, of course, have -- be multiyear characteristics. So when we looked at the composition of the quarter, what you're seeing inside of the composition between current and deferred revenue is certainly some contribution from cloud, but probably a heavier contribution today from standardization, enterprise adoption agreements.

Our next question comes from the line of Phil Winslow of Wells Fargo.

This is Joanna Kamien on for Phil. This was another healthy quarter for $100,000-plus deals. And I know this remains a focus. I was wondering how you're thinking about the pipeline for these deals in the second half and how much they're being driven by newer areas of the business, like UBA and ITSI?

The sales team has got this fun challenge of managing the run rate business as well as the bigger, notable deals. The big notable deals get a lot of attention because we can all see them much more easily. And the guidance that we just gave you guys is based on the latest views and confidence and what that pipeline looks like that we can see through Q3 and into Q4. The one of the core elements that helps us get time to value and drive success within our accounts is to be focused on use cases. Customers want a solution to their problem, and Splunk is a brilliant, flexible platform that -- making sure we cast in a way that solves their immediate problem, helps close that gap of why would I use Splunk and then how do I make sure I get value quickly. And I think, ES and ITSI are the 2 great examples of the general dashboard that a stock owner, or the general dashboard that IT ops or NOC owner would use to make sure that their systems are operating healthy and doing what they should be doing. And that helps us a lot with that use case orientation. And we're seeing ES and ITSI continue to be attached to more and more deals, and that's exactly what we want for those premium solutions. UBA is growing nicely as well. But there's also these 1,500-plus apps on Splunkbase that most of which are free that are downloaded at various rates. We just talked about the Palo Alto app on the call that has 30,000 downloads. And those make it much easier for specific use cases around different data types. So if I buy a bunch of firewall and I want to get visibility on the health of my perimeter and make sure that I've configured my firewalls effectively and that they're being monitored appropriately, then Splunk is a great solution on top of that. So it's a combination for us of we are seeing UBA, ITSI and ES be wonderful additions to their portfolio. We're going to continue to drive for more packaging and more and more use cases to make it easier for customers get that time to value, and we want to continue to enable the partner ecosystem, like we saw with Accenture, Booz Allen, Verizon as call-outs, to be able to do that as well.

Yes, hey, it's Dave. I think, just a couple added points that reconcile back to what Doug's saying, that we expect and what we laid out at our Analyst Day was that we'd see ASPs go from the mid-50,000 range to the mid-80,000 range. And that's really around 2 factors. One, just fundamentally, we know and we see it in the cohort and we see it in terms of how customers deploy the product, the more of our systems that deploy, the more value they extract from their data, and that flywheel starts to accelerate inside of the enterprise. Ultimately, our goal leading to an enterprise adoption agreement. A big component of that is the combination of our core platform, plus our premium apps, plus partner-driven solutions and other solutions that are available. So when we think about the suite of product that Doug articulated, how that gets deployed inside of the customer that leads to higher ASPs, and to your originating question, larger orders overall or more large orders.

Our next question comes from the line of Matt Hedberg of RBC Capital Markets.

This actually Matt Swanson on for Matt. I've got 2 questions that may be a little more macro-related, both around the security environment. The first would be, at the beginning of the quarter, you guys had an article you put out kind of commenting on some research about how you see, talking about how overwhelmed security teams are. And we've seen a lot of articles lately about how few cybersecurity professionals are out there, especially in the forecast. Could you talk about how these trends will kind of affect companies like Splunk and what potential there is for products like you offer to replace those manpower deficiencies and if you're seeing any of that in customers?

Sure, Matt. So when we look at the core of something like enterprise security and UBA, the value they add is -- there's a number of value points, one of which is they help with that human augmentation. Something like UBA, winnows down the sea of events, often, millions or tens of millions, I mean, there's different accounts to the handful of notable events that someone should actually pay attention to. And the interoperability between UBA and ES helps ensure that as we winnow down to notable events, you investigate them effectively with Splunk and then understand what led to it that the rule, engine and workflow architectures of ES allow you to then codify that and have that be an automated response going forward. So I think, the security analytics trend that we've been talking about for 4 or 5 years now is one of the core answers that how do you -- while most security departments have to keep deploying lots of different devices, virtual appliances, real appliances, to help cover the landscape, how do you actually get insight from all those devices? And you need an effective analytics platform to give you that insight. But how do you couple that data flow with machine learning, with predictive analytics algorithms so that you can leverage the expertise that you have, and often, pair it with some outsource expertise, too, contractors or managed security service providers. Splunk is definitely in the heart of that. I think that's a lot of the continued momentum that you're seeing in our security business.

And then, just one more quick one around security. Was any of the strength in EMEA, particularly security-based, maybe are we starting to see some of a GDPR tailwind?

I think, we're still early in the GDPR wave. I went out there like 1.5 months ago, I think, was the last time I was there. And it was beginning -- first time I'd heard it in 2, 3 quarters come up as part of many conversations. But I think, people are still trying to figure exactly what does it mean. We do believe strongly that Splunk is a key component to effective GDPR coverage. Our legal and product teams have put out some really nice white papers and how-to guides. And I would expect that you will see some interesting stuff from Splunk in the coming weeks, months and quarters that help people with this GDPR initiative. So I think, that's more of a futures than a current right now.

Our next question comes from the line of Brian White of Drexel.

Yes, I'm wondering if you can just comment on customer additions and the big deals here. I just went back in history, it looks like it's the strongest sequential growth ever for deals over $100,000 in the July quarter. So congrats there. But it does look like it's the weakest sequential growth, flattish in the July quarter for total customer additions. If you could just walk us through kind of the dynamics and is this something we should think about as we move forward as well?

Yes, thanks, Brian. So the motion that I know that we're very effective at, I've watched it for 3 solid years now, almost 4 years, is big enterprise sales. And from a headcount allocation as well as expertise basis, I think that's why you're seeing the continued surge of 6-figure deals, 7-figure deals, our coverage is effective there and then this cohort that Dave always talks about, I think, really helps us with that flywheel as well. The new -- the much more aggressive motion, I wouldn't say it's new because we've always had a team of people covering more of that commercial territory type segment. But I would say it's been underemphasized and under-resourced versus the opportunity. The core of Susan's architecture, the heart of her decision this year, was let's get significantly higher growth rates and focus and attention in that area. We've been hiring up leadership around the world. We just added a really talented folks, person in the Americas just a few weeks ago to specifically cover this area. And we've been growing the teams as well as a much tighter relationship between marketing and sales to make sure that we are sourcing, following up on and effectively closing leads that are coming from those sets of new accounts. So it is -- we've charted out as a multiyear journey. You've got to develop a set of muscles and skills that are there but are much weaker than the other sets of skills. And it's something that is our #2 and #3 corporate priorities, right, initiatives, and very important to the company going forward.

And of your cloud customers, what percent do you think use Splunk in the cloud and on-prem versus just in the cloud?

It's kind of evened out at 50-50, where 50% of them are hybrid and 50% of them are just cloud.

Our next question comes from the line of Fatima Boolani of UBS.

Doug, a question for you, just drilling into some of your comments from the prepared remarks around the joint win you had with AWS in the quarter. I'm actually wondering, in those joint win scenarios, who the implementation processes and sort of post sales support -- whose camp that falls into? And then, maybe dovetailing that into Dave's comment around the incremental cloud margins at about 30%, can you sort of help me understand how that works and how that sort of translate into your ability to get margin from those joint wins?

So the implementation piece would generally tend to be a partner of the 2 of ours. We've got a number of joint partners. It could just be a primary Splunk partner and, in some occasions, will be a Splunk processor of direct, it depends on the deal. AWS generally leans on third-party partners for implementation. But we are tightly coupled in the selling motion side with their enterprise sales force. And Dave, do you want to answer the margin question?

The margin is -- there's multiple sources in terms of margin that have been part of our plan all the while. Obviously, economies of scale has always been one, as we initiated our cloud business, getting the components that are required, the fixed cost to run cloud that have been embedded in our cost structure. And as that cloud business continues to grow and we get into variable type expenses, you see margin expansion. Couple that with many initiatives we have, both from an operational perspective, and importantly, from a products capability perspective, and you start to see the expanding cloud margins, which have been part of our plan for the next 3 -- well, we're in the middle of our 3-year plan to get to 70%.

And if I can sneak another quick one in about your deals over $100,000. I'm curious if the general sticker price on those chord of deals is actually increasing.

So is the average price per greater than $100,000 transaction larger. And I think, overall, it is across the customer base. Back to my earlier comment about, one, the greater amount of the product that you deployed a great amount of value, but importantly, when you start combining it with the premium solutions, you see an uptick in ASPs. And we expect ASPs to continue to uptick over the next 2.5 years.

Our next question comes from the line of Keith Bachman of Bank of Montreal.

I wanted to ask about the security market and you generally characterized there's about 40%. And I want to see, has there been any change in the run rate of the business in particular against the SIEM portion of your business? And how are you using -- Splunk is offering more than -- increasingly offering more than just SIEMs, and how are you seeing the diversification around the SIEM to help sustain growth? And Dave, just to sneak the follow-up then, I know it's late in the call, but I'm going to ask them both at the same time. DSOs were up a little bit. Is there anything there you want to call out specifically? And DSOs were up year-over-year, is there anything else you want to call out specifically and how do you think that will trend next quarter?

I will start off with the security piece, which is, as we talked about, that security landscape is getting more and more complex for people globally. There's a lot more notable things happening around the world. Obviously, we saw the ransomware flareup this past quarter, and we're excited to be able to respond quickly with this Splunk Insights for Ransomware package that we delivered in between the 2 big, notable ransomware events. And now we've got this SIEM replacement cycle that has -- we started seeing it probably about 1 year ago, where people were really starting to seriously think about what their next iteration of SIEM was going to be, and we see it continuing to pick up speed. And we see that -- all those are great. They're great for Splunk. We believe that we are an incredibly valuable and tight partner to both the security vendors as well as the customers that are trying to deal with this very difficult task. And the beauty is the data that you're reading in for security is often usable and highly valuable for further use cases outside of security. But that packaging you saw for the Splunk -- around Splunk ransomware is the theme that I think you're going to see from Splunk in the coming quarters, which is an additional set of packages that focus on the different buying centers that have security-oriented needs. In the compliance arena, in the fraud arena and then just different departments within the general cybersecurity department coming out with more specific packages around perimeter defense, as an example I was giving earlier, reading in firewall data and network packet flow data and others to make sure that your perimeter is well-defended.

Yes. And hey, it's Dave. As it relates to DSO, nothing there. We're certainly very happy with the trajectory of our enterprise adoption agreements, which tend to be larger. Those tend to happen towards the end of the quarter and can contribute a day or 2 to DSOs, but there's nothing anomalous there.

Our next question comes from the line of Nate Cunningham of Guggenheim.

Dave, on gross margins, is 400 basis points still the right way to think about the impact from cloud this year?

Yes, it was -- back at the beginning of the year, I said it's roughly 5. It's still -- it's moving down. But obviously, nominally, given its overall contribution, so call it 4 to 5 drag.

Okay. And for Doug, when you talk about the SIEM replacement cycle, what inning are we in? And how much of that would you estimate is tied to the impending ownership change. Is it one of your main competitors?

Good question. I think that we're still early in the innings. The majority of Splunk implementations in and around SIEM vendors is still integrating with. I think that some of the market moves probably have an impact. But that cycle really is past its 10-year mark from kind of the gold rush and the big push of both ArcSight and other vendors that came in around the same timeframe. So I think that, as the security landscape is changing, pretty notably, and organizations are moving to a much more of a heavy analytics, machine learning, big data approach to security, they need a technology solution, both app and underlying capability, like Splunk has, to help them manage that. And I think that's probably the biggest drivers, it's just the natural, next generation upheaval.

Our next question comes from the line of Anne Meisner of Susquehanna Financial.

I have a multipart question related to the Booz Allen partnership. First of all, can we expect to see a GA version of that in the market at some point soon, the Splunk Enterprise Security, I guess, integrated with their threat intelligence? And then, secondly, there are a lot of great vendors out there with unique threat intelligence. Can we expect to see additional partnerships in this area where you integrate third-party intelligence into Enterprise Security? And then, last quick one for Dave, and I apologize, Dave, in advance for mentioning 606 again. I know you wanted to get through call without discussing that. But I'm just wondering if you provide a bundled solution with a threat intelligence subscription with that potentially allow you to recognize those particular term deals ratably under 606?

Yes. Hey, thanks, Anne, for -- let me put on my propeller hat accounting dissertation. The quick answer is, ultimately, what you need to do in 606 is look at all the components of what you deliver and assign a fair value to those. And if you have a threat intelligence component that is continuously delivered and it's tied back to the bits that you've deployed on-prem, that would be upfront under 606, you could argue those would be a single delivery mechanism, therefore, recognized ratably. We don't have that product offering today. We're not forecasting that product offering today in that structure. So as we implement 606, we'll be updating everybody about how to think about our product portfolio, how those get delivered and how we have to assign fair value to each of those components and what the associated rev rec is.

Anne, yes. Booz Allen, I'm really glad you noticed that and focusing on it. I've been pounding the table since I got to Splunk about how important partners are and how that's a piece that we just haven't leveraged strongly enough. Absolutely, Booz Allen has full intent to get that thing from a beta to a full GA and productization. We are working with, currently, already, a number of different threat intel providers, high-end, actually nominated and centered the security research activity around one of our top technical and overall Splunk leaders. A guy named, Monzy Merza, almost about 1 year ago. And he has been hiring a set of team of researchers to populate Splunk Enterprise, and it's a similar framework with UBA with a threat Intelliflo, which is a mash-up of work that we're doing in third-party work. So we see it going along your lines of thinking. That's definitely what high-end team have been thinking through over the past year and change, both our own and third-party as a key delivery set across the security portfolio. And actually, I think, we can use a similar orientation even around IT ops, app dev, app delivery, where that is increasingly become -- going to become an analytics-driven, machine learning-oriented set of activities that ideally will see the same disruption that we've been seeing in the same marketplace as ITSI and the future packages that we're rolling out gain more and more traction there.

Our next question comes from the line of Sarah Hindlian of Macquarie.

I wanted to ask you guys about your EAA strategy. You called out, it sounds like, some very nice EAA deals in the quarter. And I want to hear how your sales force is doing with that now? What you're seeing there? And how you're really driving more all-you-can-eat usage?

Thank you, Sarah. So first of all, EAAs are not necessarily all-you-can-eat. There are different variations of EAAs. But the core purpose is to take away the concern that customers may have on lack of predictability on what their exposure to Splunk might be. And the ultimate EAA is, hey, it's unlimited and go to town. And you likely have all heard me say in past calls, I'm a little bit frustrated with the non -- that not every rep is out there pounding the door down on their customers saying, hey, there's this thing called EAA and let me tell you about it. We have -- Susan has made really good traction around that the past 2 quarters, and I literally just sat through a presentation, I think, yesterday, a day before or sometime this week with our best practices team and our pricing team that have rolled out a consistent set of frameworks and tools and education and literature to make it as braindead simple as we possibly can for any rep to approach any customer and have the right discussion on how we can make it easy for them to get away from the lack of predictability and be able to go big with Splunk. We are seeing continued traction there. You can see that with -- EAAs are not always big deals. There are a few smaller customers that do -- have done EAAs with us. But certainly, the biggest deals also tend to be EAA-driven deals. And my desire and goal is to see as many customers as we can possibly get that -- for a department-wide usage and increasingly, corporate-wide, but we're seeing a lot of use is all of security really wants Splunk across all the different use cases or all of IT does, et cetera. The more that we can get, the better. I think its' great for the customers and it's a nice recurring and effective way for us to run the business as well.

All right. That's very helpful. And so is there anything you can do on with your data cap as well to help that along? Is there any strategy there that you're thinking about just as a follow-up?

What do you mean by data cap?

So when your customers are running through their license and you're going to go sell them more, is there things you can do to smooth out that process and make it a little bit less friction?

I've got it. Okay. So I think, the biggest time-dependent -- the longest pole in the project plan on getting to an EAA is getting the customer to the point where they fully grok where the power of Splunk is, that 1 plus 1 equals a lot more than 3 or 4 with the different data types. And the more data and the more variety of data, the more correlations and insights they tend to get. And there's usually a journey with the account where we drop in with a very specific departmental use case to get them going. And do that a few times across a couple different departments and then start to connect the dots. So I still see that as the biggest impediment. And to try and get around that, this packaging that I've been talking about, you'll continue to see coming from Splunk, which allows us, partners and customers themselves to much more rapidly create use case-specific solutions around Splunk. I think it's one of the biggest levers that we have to push on to get that momentum going to a point where the customer now wants a department-wide or corporate-wide licensing structure.

Our next question comes from the line of Kirk Materne from Evercore.

Doug, just want to ask you just a question about sort of partner momentum these days. At one of the SplunkLive you were at recently, Partners' commentary around some of the things you're doing, I think, were definitely more constructive, or more upbeat, I guess, versus perhaps maybe 1 year ago. I'm just kind of wondering what kind of progress you've seen on that front and what you are hoping to get in terms of sort of a force multiplier in terms of your go-to-market strategy from the partner channel as we look out, say, 6 to 12 months?

Thanks, Kirk. The hard part about so much what we talk about is you lay the investments for a lot of our initiatives 4 quarters, 6 quarters, 8 quarters before you actually start to see the true fruits. And I think, Partner has been one of those. Obviously, we've been talking a lot about how do we get after net new and the lower accounts as one of those that we're investing a lot in now that we'll see the returns over time. I agree. I mean, I've been hearing what your year. I'm hearing a lot more positive things from the partner community. We really started that journey 2-plus years ago. The latest rollout of our partner portal, I think, it was a really good step that put automation and replication of scale in place for a lot of the human programs that we put in place 1.5, 2 years ago. We're seeing partner-originated registration, deal registrations go up. And I think a piece of that is they now have an easy way of doing that and it's all automated. There's a lot more effective education and self-service all the way down to marketing development funds and other activities that the partners now have access to. We've, over the years, over the past 1.5 years, 2 years, we've built up a lot more technical resource to help get these guys enabled. I think, a lot of those packaging we're talking about will help them. We've been running some experiments with different partners for how do you tie Splunk, not just sell Splunk native, but tie it to 1, 2, 3 different technologies and do the true value-added work that I think helps differentiate them and speeds up the sales cycle. So it's a constant drumbeat. And I think, Susan, Sherilyn and a woman named Brooke Cunningham and a whole host of other people that have been working at this for a while are starting to get some of the results. And it's definitely something that has a top priority -- has been a top priority for the company and will continue to be going -- given that we've always got -- David and I always talked about coverage, coverage, coverage. How do we get enough feet on the street? And we need our partner community to be there with us in a way that they add value to help with that coverage piece.

Our next question comes from line of Mark Murphy of JPMorgan.

This is Albert Chi actually on for Mark. But I wanted to ask if you can quickly comment on what you're seeing vertical-wise. And I know that you noted some impressive customer wins, but was there any outperformance in any sector that you'd call out? And kind of related to that, could you talk about the federal space and the opportunity that you're seeing, especially as we're nearing the government fiscal year-end?

Thanks, Albert. I mean, we have -- the only real vertical that we've carved out in the go-to-market motion, and it's been carved out for 5-plus years, is public sector, which is kind of classic definition of federal, state, local and education. That is principally U.S. Although, we've now implemented that in a handful of other countries where we've got a little bit more maturity. And that's been a really, really important go-to-market initiative for us. That's why we're replicating outside the U.S. They're a critical customer base. And obviously, their data needs are very high, especially in the security space. So it's important. We remain focused on it. And while there's an end of year cycle with the U.S. government that we're experiencing, there's an end of year cycle every year. So I'm excited about what our team is going to do. But there's a year-over-year impact that mutes that a little bit. The other verticals that we've tended to be a little bit stronger in, and it's probably more just their -- both their ability with technology and engineering as well as our data creation and consumption needs, has been telecommunications, financial services and Web-based properties or high-tech properties. And Susan has taken -- we had about a 2-year journey there to start to allocate more people to those in addition to some of the IoT work we're doing with manufacturing, health care and a handful of other verticals. But we have seen some of these big EAAs, particularly if I carve out financial services or telco, really start to become something that the customer demands as we get into line of business-oriented use cases in these verticals. I'll give you one quick example that we see replicate across different telcos. Obviously, quality of service delivery is critical to them. And it's really, really difficult for them to do. There's a lot of variance and variability in cell tower switchover and cell tower coverage and the huge complexity of equipment from a multitude of vendors on a landline, hard-line distribution and allowing Splunk to aggregate some of the data around that and do that ML and analytics work to optimize their performance is something that we've got some really good use cases around. That's a very different area of classic security, IT ops type of work that has material revenue and customer set impact. So those types of activities, I think, are what we're looking for as we start to aggregate some of our go-to-market as well as marketing and some product folks around some of these verticals.

This does conclude our Q&A session. I would now like to pass the call back to Mr. Ken Tinsley for any closing remarks.

Great. Thank you. And thanks, Geronimo, I really appreciate your help today, and thanks, everyone, for your participation. As always, if you have any questions, please feel free to contact us here tonight. We'd be happy to help out. Thanks so much. Have a good evening.

Ladies and gentlemen, thank you for participating in today's conference. This does conclude the program, and you may all disconnect. Everyone, have a great day.