Splunk Inc (SPLK) 2018 Q4 法說會逐字稿

Ladies and gentlemen, good afternoon, and welcome to the Splunk Inc. Fourth Quarter 2018 Financial Results Conference Call. (Operator Instructions) As a reminder, this conference call is being recorded. I would now like to turn the call over to your host, Mr. Ken Tinsley, Corporate Treasurer and Vice President of Investor Relations. Please go ahead, sir.

Great. Thank you, Amanda, and good afternoon, everyone. With me on the call today are Doug Merritt and Dave Conte. We issued a press release after close of market today, and it is posted on our website. Additionally, this conference call is being broadcast via live webcast and then following the call, an audio replay will be available on our website.

On this call, we will be making forward-looking statements, including financial guidance and expectations, including our forecast for our fiscal quarter and full year of fiscal 2019 and our expectations for fiscal 2020. Trends and expectations regarding customers' deal size, international revenue as well as transaction, product, services, subscription and revenue mix, planned investments and trends in our operating model resulting from our investments and the impact of the adoption of ASC 606 to our financial statements. These statements reflect our best judgment based on factors currently known to us, and actual events or results may differ materially.

Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements.

These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information. We will also discuss non-GAAP financial measures, which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.

Before I turn it over to Doug, I want to remind you that we're holding our analyst and investor meeting at the end of the month, and we look forward to seeing you there. Go ahead, Doug.

Thanks, Ken. Hello, everyone, and welcome to the call. Having just flown in from our annual sales kickoff, I am excited to be talking to you all about the opportunity in front of us. I'm proud of our delivery and our execution in FY '18, and our confidence heading into FY '19 couldn't be higher.

Our energy comes from a great Q4 where we delivered $420 million in total revenue, up 37% over last year. We saw strong demand for Splunk solutions globally, such as in Europe with a win of Deutsche Bahn and the Middle East with the Saudi Department of Zakat and Income Tax; and APAC with Domino's Australia; and in Africa with GTBank of Ghana.

For the full year, revenue totaled $1.271 billion, up 34% year-over-year. Our growth continues to come from a combination of new and existing customers, expanding their deployments both on-prem and in the cloud, and we exited the year with more than 15,000 customers.

I'd also like to thank our partners from around the world who joined us at our sales kickoff. It was inspiring to see our collective teams driving the alignment that is so critical to ensure that we capitalize on our mutual opportunity. Most importantly, our customers continue to be the #1 source of inspiration for every Splunker and every partner.

At our Analyst Day last year, we shared with you the go-to-market model changes that Susan was rolling out. We're investing and optimizing our demand-generation activities and field segmentation and coverage to accelerate customer success. As part of our go-to-market evolution, we're thrilled to welcome Richard Timperlake as our new EMEA sales leader under Susan. Richard joins us from Qlik, where he was the EVP of global sales. I am happy with the changes we made thus far, and our strong results continue to validate what we've said before. Our market opportunity is massive. And we're still early on the Splunk adoption journey even within our largest accounts.

Earlier this week, we announced our agreement to acquire Phantom, a leader in Security Orchestration, Automation and Response, also known as SOAR. The combination of the Splunk platform, Enterprise Security and Phantom's products, talent and technology will help Splunk customers stay ahead of the fast-evolving threat-and-attack landscape and handle the growing complexity of alerts and analytics for better decision-making.

In addition to security, we're also looking forward to leveraging Phantom's automation capabilities for IT and other use cases. Technologies like these and the teams behind them fit into our broad strategy of leveraging the ecosystem around us as an extension of our own R&D efforts. We look forward to welcoming Oliver, Sourabh and the Phantom team to the Splunk family.

Organizations are increasingly using machine data to provide critical context to the transactional data they store in their databases and data warehouses. Splunk's platform is the best solution to enable customers to harness these data sets to gain operational intelligence. There is no other solution on the market today that does what we do, and our customers are gaining more insights from their data than ever before.

What continues to be unique about the Splunk platform is the ability it gives our customers to ask different questions of the same data across multiple use cases. We continue to learn from our customers' experiences as we both introduce new solutions as well as ramp our delivery of prescriptive recipes that can be rapidly implemented using the Splunk platform. These recipes are designed to help customers solve critical pain points quickly. We're calling these recipes Splunk Essentials, and we're providing them on Splunkbase for our customers and our partners. A good example of the new solution is Project Waitomo, which we previewed at .conf. This solution makes infrastructure monitoring easy and is specifically built to help systems administrators and site reliability engineers who may have never tried Splunk and need to get up and running in minutes.

An example of a prescriptive recipe is Splunk's ability to help customers comply with the upcoming GDPR regulation. In Q4, TDC, Denmark's largest telco, became a Splunk customer purchasing Splunk Enterprise and Enterprise Security for their GDPR use case. Thanks to our partner Netic, who is instrumental in this opportunity.

Moving on to Q4. We saw continued momentum in both our Splunk platform and in our premium apps. Starting with ITOps and app delivery. Wins in the quarter include The Cincinnati Insurance Companies who added Splunk IT Service Intelligence, or ITSI, to proactively identify and resolve IT issues and expand their use of Splunk Cloud. A joint AWS Marketplace win was global payments provider, Worldpay, who expanded their use of Splunk to support new use cases and help their business as they spin up new workloads in the cloud. New use cases for Worldpay include artificial intelligence and IT operations, visibility into storage, network virtualization and container environments and more proactive security investigation and response.

The State of Delaware is a Splunk customer taking on significant digital transformation initiatives. They made a Splunk upgrade to get complete visibility into their technology infrastructure as they grow.

We're also very proud to provide 3 Splunk licenses and training to a major higher ed institution via Splunk Pledge helping to support some of the cybersecurity workforce initiatives recently introduced by Governor Carney. Other customer wins this quarter include Tampa Electric Company and Statnett.

Moving to security where we continue to help our customers migrate from a structured legacy SIM to an analytics-based approach. Notable security wins include: Texas State University System, who's a new Splunk customer; the CSO at San Marcos, a customer since 2014, presented their success story to all university CIOs, which led the entire university system to deploy Splunk Enterprise for a wide range of security IT and IT use cases; British satellite provider, Surrey Satellite Technology, expanded their use of Splunk Enterprise, ES and ITSI and added User Behavior Analytics this quarter. UBA as an additional layer to the company's security operations center with insider threat detection around their user accounts to further reduce risk and protect their brand, while ITSI is used to ensure their business services are always available. In the future, the company plans to take data directly from satellites to monitor the success of missions and take preemptive measures to avoid issues and breakages.

San Francisco has always been home to Splunk, and we're proud that the City and County of San Francisco is using Splunk Enterprise and Splunk ES to better defend against cyber threats and meet compliance and auditing mandates.

Other customer wins in security include: Los Angeles World Airports, Nashville Electric Service and Australian Digital Health Agency. In Q4, we continue to see multiple customers standardize on Splunk as their data platform, including The Washington Post, who's a long-time customer using Splunk Enterprise for use cases across the entire organization, including SIM, monitoring e-commerce activities, improving DevOps, processes management and monitoring marketing data to improve its subscription rates.

Penn State University signed an EAA for Splunk Enterprise, ES and ITSI to provide campus-wide visibility into their IT and security operations. Penn State is going to use Splunk to ensure their applications and websites stay online during heavy load times. Penn State also uses Splunk to provide a connected campus so their students and faculty and to save time and money by reducing MTTI and MTTR.

Another customer going all-in on Splunk is transport and logistics company Deutsche Bahn, with their internal IP supplier, DB Systel, signing an EAA for Splunk Enterprise, ES and ITSI. This expansion is a core part of their digital transformation, and Splunk will deliver insights around everything from Internet of Things use cases, like predictive locomotive maintenance, to improving the customer experience when someone books a train ticket.

Shopify, the leading commerce platform, purchased an EAA to expand its use of Splunk Enterprise. The expansion helps maintain their commerce platform and customer support management systems.

And finally, Yelp expanded its use of Splunk Enterprise this quarter with more than 10 terabytes of machine data streaming through AWS every day. Yelp originally deployed Splunk several years ago to correlate all log data in one central point so people across the company could get answers to business and operational questions. Today, Yelp uses Splunk to enhance its operational intelligence to analyze business, application and system trends.

We also saw our cloud business continue its momentum. A sampling of our cloud wins in the quarter include Guardian Life Insurance Company, who expanded their use of Splunk Enterprise and ES and bought Splunk Cloud. After previously using ES to replace its legacy SIM, Guardian will use Splunk in a hybrid approach to meet new regulatory guidelines and reach corporate goals in DevOps, IT operations and application performance. This is another win that came to the AWS Marketplace.

The University of Vermont Medical Center made a significant expansion and is leveraging Splunk for some of our classic IT use cases, such as network and app monitoring and proactive alerting to ensure the hospital's critical systems are operating at their best.

Moving on to the ecosystem. Q4 saw great momentum with our strategic partnership with AWS. We worked together on several joint opportunities, including an EAA with a global Fortune 500 entertainment company. It was one of our larger wins in Q4 and our largest win ever on the AWS Marketplace. We also announced new integrations with Amazon Kinesis data Firehose and Amazon GuardDuty, our latest integrations to help our customers get more value from their AWS data.

This quarter, our strategic partner, Accenture, created a new community of practice specifically for Splunk within their security business unit. It's the first time that Accenture has established a vendor-specific community of practice within their security business. This new community gives Accenture's customers a place to learn from Accenture's Splunk experts and gives them access to unique knowledge-sharing platform made up of other passionate Splunk users. Ultimately, this will enable our joint customers to better detect, defend and remediate cyber threats.

Finally, our partner NTT Security expanded their license as part of their continued investment in enhancing their advanced managed security service offering with Splunk Enterprise. NTT expects Splunk to complement their current offerings and believes their customers will proactively find threats and execute response much more efficiently.

In summary, it was a great quarter and a great finish to FY '18. I'm really proud of the whole Splunk team. We're uniquely positioned to capture the tremendous opportunity in front of us, and we are pursuing it aggressively. We are early in our journey, and we are investing for scale and for growth. We're delivering high value to our customers. We're expanding their adoption of Splunk as their platform for machine data analytics, both on-prem and in the cloud. Again, thanks to all of our customers and partners and thanks to everybody who works at Splunk.

Now let me turn the call over to our CFO, Dave Conte.

All right. Thanks, Doug. Good afternoon, everyone. Thanks for joining the call. I'm pleased to report another strong quarter, which caps a solid year for Splunk.

Fourth quarter revenues were $420 million, a 37% increase over Q4 of last year. For the full year, total revenues were $1.271 billion, up 34% over last year. Cloud revenue was $30.7 million in Q4 and totaled $94 million for the full year, up nearly 100% over fiscal '17, and full year cloud billings were $181 million. Q4 software revenues, which is the total of license and cloud, were $285 million, up 38%. Full year software revenues were $788 million, up 32% from last year. And full year total billings were $1.55 billion, up 38% over last year.

Now as pleased as we are with our execution, we're not satisfied. As you've heard us say, we have a unique opportunity to establish Splunk as a standard for our customers and their data analytics, and we will continue our focused investments in our product portfolio, our market groups, our field coverage and the cloud to ensure customer success. To that, in Q4, we added over 570 new customers. And for the full year, we added over 2,000 new customers overall, ending with 15,400 customers globally, on pace to our fiscal 2020 target of 20,000 customers.

Our continuing commitments to product innovations around our platform and solutions as well as our continued pricing and packaging programs are accelerating Splunk adoption. In Q4, we recorded more than 850 6-figure orders. And for the full year, we booked more than 2,300 6-figure orders, 271 7-figure orders and 10 8-figure orders, which compares to 6 total from company inception through the start of fiscal '18.

International operations contributed 31% of Q4 revenue as our international teams continue to help customers along their path with Splunk. Full year contribution was 26%. And longer term, we expect to see our international teams contribute between 30% and 35% of total annual revenues.

Our education and professional services represented 7% of revenues in Q4. The increase in large orders is reflected in ASPs this year. In fiscal '18, license ASP reached $95,000, up from prior levels of $60,000 to $70,000. Overall, our growing product suite, complemented by increased awareness and compelling ROI together are driving this type of broad and large-scale adoption.

Now turning to margins and other results, which are all non-GAAP. Q4 overall gross margin was 85%, comparable on a year-over-year basis. Q4 operating income was $73 million, representing a positive margin of 17.4%. And Q4 net income was $53.9 million or $0.37 per share using a fully diluted weighted average share count of 147 million shares.

For the full year, operating margin was 9.2% above our expectations due to the strength of our overall top line performance. Net income was $89.2 million or $0.62 per share based on a fully diluted weighted average share count of 144.9 million shares. These results translate to cash flow from operations in Q4 of $146 million and free cash flow of $139 million. For the full year, cash flow from operations was $263 million. Free cash flow was $242 million, and we ended the year with almost $1.2 billion in cash and investments.

Now turning to guidance. Based on the strong finish to fiscal '18 and continued momentum in the business, we are increasing our fiscal '19 full year revenue expectation to $1.62 billion,(sic-see press release "$1.625 billion") up from the $1.55 billion we previously guided. We are also reiterating our fiscal 2020 target of $2 billion in total revenues. Fiscal '19 cloud should contribute billings of about $270 million and revenue of about $160 million.

Our fun topic, the impact of 606, which we adopted as of February 1. This will be evident on the face of the financial statements going forward. Importantly, all of our fiscal '19 and '20 guidance has been on a 606 basis, and we have elected the full retrospective reporting option so you'll be able to compare our results on an equivalent basis. Under the full retro method, fiscal '18 and fiscal '17 revenue will be recast. Specifically, fiscal '18 revenues of $1.271 billion under 606 -- I'm sorry, under 605, will increase to $1.309 billion under 606. FY '17 revenues of $950 million under 605 will become $944 million under 606. So what you now have is 4 consecutive years of revenue results and guidance: fiscal '17, '18, '19 and '20, all on a 606 basis.

Now you've heard me talk about headwinds and tailwinds to revenue from 606. Clearly, the largest headwind is the reduction of deferred revenue, and the largest tailwind is term license bookings, which will now be recognized upfront. Additionally, with the growing contribution of subscription contracts in fiscal '19, we expect another headwind as overall order sizes for subscription transactions are generally about 2/3 the size of a perpetual order. Now the net impact of all these items are included in our updated fiscal '19 and fiscal '20 revenue guidance.

Our fiscal '18 subscription mix, which we have updated to include all cloud-related amounts, was 50% and compares to 48% in fiscal '17. Our outlook of 65% in fiscal '19 and 75% in fiscal '20 are on this same basis. Without this adjustment, FY '18 mix was 48% and fiscal '17 was 46%.

Now given the impact on the balance sheet from adopting 606, we will no longer provide overall billings guidance. Going forward, disclosures will be in accordance with the new accounting standards.

With 606 also comes the requirement to capitalize and amortize certain sales commissions. Up to now, we fully expense commission in the quarter it was earn. We expect that the operating margin benefit from capitalizing commissions will likely be in the 1% to 2% range, the bulk of which we will reinvest back into product and field initiatives. So given our op margin outperformance in fiscal '18 and considering the benefit we expect to receive from the commission changes, we are increasing our op margin expectation for fiscal '19 to 11.5%, up from the 10.5% we previously guided. We will continue to focus our investments on delivering our #1 company priority of customer success. We remain disciplined about how we expand our product lines and ensure our coverage model continues to deliver top line growth at these absolute levels.

Given our fiscal '18 performance and expectation for fiscal '19, it is likely that we will achieve an op margin performance in fiscal '20 at the high end of our previously guided 12% to 14% range.

Now looking at the quarterization of fiscal '19. As I mentioned on the last call, 606 will cause the weighting of revenues to be steeper, likely 40% to 60% first half to second half, with the largest impact in Q1 where we expect total revenues of between $295 million and $297 million. Our op margin will be seasonally impacted as well. We expect non-GAAP operating margin of a negative 6% in Q1, turning slightly positive in Q2 and then ramping in Q3 and Q4, consistent with the trend we've seen historically.

Just to add on some more fun. With the recent changes in tax laws, we are reducing our estimated effective tax rate to 20% from 27% previously provided.

And finally, for EPS calculations, since we expect to be in an operating loss position in Q1, you should use a share count of about 144 million shares for your calculations.

The transition to subscription also has an impact on cash flows, particularly this year as we're moving to 65% subscription. With this move, current average dollar duration cloud and term transactions of 2 years should start to shorten as customers typically pay annually under subscription contracts. Reflecting this, for fiscal '19, we expect full year operating cash flow of about $300 million and free cash flow of around $275 million. The cash flow generating capabilities of our business are strong, especially when you think about our growth trajectory on our path to $2 billion and beyond.

In closing, our Q4 results and full year performance were solid. Our product investments are driving customer success, and our field expansion is enhancing our overall execution capabilities. Our strategy is working well, and we will continue to fuel this pace of adoption as we drive to make Splunk the machine data platform for our customers.

Thanks much for your time and interest. Look forward to seeing most of you, I hope, at our Analyst Day later in the month. And now we'll open it up for questions.

(Operator Instructions) Your first question comes from the line of Kash Rangan from Merrill Lynch.

"He's a rebel and a runner, he's a signal turning green, he wants to run the big data machine," that's the New World Man lyrics for you, a bit of a Rush (inaudible) thing. Congratulations, guys. I think those lyrics really exemplify the transition that you guys are going through, especially the signal turning green. A question for you, Doug. The tactics and the strategies that a $1 billion revenue company is used to employing for success are not the ones that usually work for a company that wants to be a $2 billion, $3 billion revenue company. Clearly, you guys have undisputed market position in the space that you've been defining. And since given your experience at larger companies and smaller companies, how do you view the strategy when it comes to go-to-market, product development, marketing, applicationization of the product? How do you see that changing as you build the foundation to become a multi-billion dollar revenue company? And for Dave, a simple question for you. It looks like the revenue recognition is going to be ahead of the -- in the subscription transaction, the revenue recognition is going to be accelerated, right? So how should we think about the way the company salespeople will be incentivized to go sell contracts given there's the potential risk, and maybe it doesn't exist, that what you intend to be subscription will actually become license sales? Just wanted to get your thoughts on that.

Thanks, Kash, it's Dave. Obviously, the simplest way to think about rev rec for us where we sell both on-prem and in the cloud is the on-prem rev rec will be treated the same. So a subscription term contract, which historically would have been recognized over time, will be recognized upfront just like a perpetual contract. And our customers really deploy our products dependent on the use case and the data location between on-prem behind a firewall or in the cloud. The implications of these chances as we move to 65% subscription, which would be all of on-prem term plus cloud, to 75% is reflected in the guidance. And we felt it was important to not only provide the outlook for fiscal '19 and '20 on a 606 basis but adopt the full retro method for the 606 implementation, so we give you fiscal '17 and '18, basically a 4-year view, in terms of revenue trajectory and growth for the company.

And on the first question, Kash, and thank you for the Rush intro.

That was a Signals album, Kash.

Yes, a good album. We really focused on Analyst Day on highlighting this business model transition. Moving from largely a perpetual company to eventually an all-subscription or virtually all-subscription company is probably one of the more disruptive things that a company can do. But given the need for both the market opportunity in front of us and continued growth, we felt and feel that it was critically important to do. To bring that to life, as you highlighted there, are 3 main knobs that you got to turn in addition to all the core processes on that subscription orientation. You've got to drive the right product strategy. And as you talk about the platformization of the product, continue platformization so we could have a growing and more effective and monetizable ecosystem of partners is key. The sales -- continued sales migration, both from a heavy direct to a much more blended group but also continuing with segmentation, both on size of the company and beginning to introduce vertical segmentation, and as we talked about at Analyst Day and we've highlighted in a couple of calls, the continued transition, the marketing function as well, getting much more aggressive on touchless, viral, online, high-demand gen activities to complement the really effective branding and high level awareness approach that Splunk, I think, was very effective and still remains effective at doing. So those are all -- we're going to talk about -- we're going to -- we're investing -- we're taking a portion of the margin and continue to invest it back in the company to ensure that those transitions continue their momentum and we exceed -- do deliver on and exceed our expectation in a subscription transition.

Your next question comes from the line of Raimo Lenschow from Barclays.

I wanted to double-click on Phantom, first of all. Dave, did you guys have the number of how much came from security this quarter? Like just a quick numbers question, and then my real question comes.

Raimo, yes, the security contribution was consistent with the prior quarter, above 50%. As Doug mentioned, we're getting a lot of benefit from customers moving to that analytics-based approach.

Okay, perfect. So the question was for Doug then actually. So Doug, with Phantom you're just going deeper into security, and it's a good detail and it's great to have strong leadership to go deep into security. How do you make sure that you don't become a security company over time, going back to Kash's question that you want to go to kind of like $2 billion, $4 billion and higher longer term?

You bet, Raimo. Yes, we obviously are very, very enthusiastic about adding Phantom to the Splunk family. They were off to an incredibly good start with some of the customers that we share with this overall orchestration automation framework that they have. Our customers were -- they and our customers actually and many of our partners were continuing to highlight that there's so much leverage potential between the solutions. That would be an important addition to Splunk. Off the bat, it's going to -- like Enterprise, it's going to -- and UBA, it's going to directly contribute and impact our security footprint to ensure that the typical SOC participant has a full range of capability from data discovery all the way through to ensuring effective remediation and action and AI on all steps of the process. But the underlying componentry will increasingly be available to all users of Splunk. As we know, the intersection between IT and security is really tight. Cybersecurity relies on what the IT group provisions and provides for them. But we also should see the orchestration, automation elements surfacing in business analytics and IoT. The interesting part about Splunk, we've talked about over and over, is where you land is different than where you actually wind up occupying. Washington Post and Penn State University were 2 examples in the scripts where they have security, IT and business operations under wraps with Splunk. And in both those cases, we landed with a specific solution. But then they saw the value of Splunk as a platform and continue to cross the different dimensions of use cases.

Okay, perfect. So it's more like it's a landing spot and then you can branch out from there, okay.

Yes, we are -- it's a sad predicament for the universe that security is so topical and something that, obviously, we're responding to very, very aggressively as a company. And it just -- for us, that provides the entry point for additional value down the road. And the whole point of the market group -- so there's Haiyan and the entire ecosystem around Haiyan, who leads our security practice, wakes up every day, and all they care about is using Splunk for success in security. But Rick wakes up just as hungry for ITOps and AppDev, and Ammar wakes up just as hungry for IoT. In the collaboration between them, I think, is really what the customers are looking for as they go deeper and deeper with Splunk.

Your next question comes from the line of Brad Zelnick from Credit Suisse.

My first question for Doug. Doug, having just come back from Sales Kickoff, what are the themes you're instilling into the sales force of this year? And what different behavior are you incentivizing in the comp plan? Because it seems like you've come off of last year with so much momentum and such a stellar performance, it seems like it's tough to beat. And I've got a follow-up for Dave as well.

Well, thank you, Brad. So the core theme of SKO was the colossal opportunity in front of us. We focused on a couple of key elements of the company strategy that I think is centered with product but really are around the -- what a customer cares about from Splunk that we got to continue to execute around. The first pillar is time to decision and successful execution of that decision in more of a real-time operational intelligence basis. The second is overall cost opportunity and other of getting to that decision and action. And the third is trustworthiness of those decisions which, as we look forward over the coming years, we're going to be much more data-driven ideally, and there'll be humans involved but not on every single response as we see with Phantom and SOAR. So how do you make sure that you surface the right degree of transparency and veracity of the data and the algorithms themselves so that we all feel comfortable with the decisions that are being made around us. From a focus for the sales team perspective, as you'd guess, the commission plan continues to make it very valuable to our reps and our partners to lead with term and with cloud so we can continue to drive this march to be a subscription-oriented company. And we've got a whole series of Splunk Essentials and plays as well as a lineup of some pretty exciting product as well that helps the partner and Splunk team be able to lean forward with a specific use case and then bring the right deal architecture that increasing will be -- increasingly is going to be this term and subscription-based approach to quickly solve that problem for the account.

I appreciate that. By the way, we're huge fans of Phantom preacquisition and really look forward to what you guys are going to be able to deliver together as one. But for Dave, Dave, you're ahead of where you thought you would be on cloud a year ago. What do you need to see to raise your 2020 view on cloud? And how should we think about the customer preference and take rate of cloud today versus what you might have thought a year ago?

Yes. Hey, Brad. Ultimately, the customers' vote is the loudest, and it really gets down to the specificity around the problem that they're trying to address. And with workloads continually moving to the cloud and, in particular, lots of folks leveraging public cloud, I mean that's really a sweet spot for us. We have, I think, neutrality across all the public cloud providers and the underlying service that we give to customers is to be able to put their information in these locations with confidence and then access it real-time. So I think, over time, it really is going to be the customers' momentum around where they want to locate their data and then how they want to pair that with whatever they retain behind the firewall that's going to have the biggest impact on the rate of growth or the contribution overall from cloud.

Your next question comes from the line of Philip Winslow from Wells Fargo.

I've got a question on, call it, new customers and expansion because it looks like this year was just a phenomenal expansion year and, obviously, you continue to click off a lot of new customer wins as well. As you look forward this coming year and then in terms of just your longer-term guidance, how are you sort of expecting that, that mix to trend and then just particularly, just on the new customer side because, obviously, the expansion is quite strong right here? So just any color there would be great.

Thank you, Phil. Yes, I've talked about our priorities and initiatives last year, and we refreshed them this year. And new customers remains one of our top initiatives for the company. We're really happy to have welcomed over 2,000 new customers to Splunk this year, but we expect that we absolutely can do better than that. And a lot of our investments are geared to focus specifically on this area, which is part of why, again, we continue to drive investment across coverage and products over and over. An example, I think, of something that will impact that metric this year is this Project Waitomo, a product that we announced at .conf. It's a low SPL, very simple point-and-click, auto data populate product that is focused specifically on site reliability engineers, SREs, and infrastructure owners. So that I think principally, it will hit new participants to Splunk that may want something much easier to use for installs or to populate with data and fills up screens of both potential alerts information and then recommended actions, so that you can get time-to-value in minutes without some of the technical expertise that a traditional Splunk footprint installs. That's just one example of the ways within product, sales, marketing and channel that we're trying to attack this new customer opportunity set.

Hey, Phil, it's Dave. We've talked several times in the past about the cohort for customers. And that after 5 years from initial purchase, they'll be at 10x the amount of data, roughly 7x the economics. So when we look at the composition of the large transactions, one of our other initiatives that -- we talk about new customers, but adoption has been a long-standing initiative for us, all tied back to customer success. And if I look at the composition of our largest orders, almost 300 7-figure orders in the year, the vast, vast majority are existing customers as they move from single instance to multi-department to broader standardization and, ultimately, EAA. So we are focused on ensuring that we get to our $20,000 -- 20,000-customer mile marker, but equally on ensuring that the customers that we do have our optimizing their Splunk investment and getting ultimate value from it. And I think that's depicted in terms of the metrics I provided around 6-figure and 7-figure and 8-figure transactions.

Yes, that's great. You actually answered my other question, I was going to ask about the deal size, Dave.

You next question comes from the line of John DiFucci from Jefferies.

Sorry about that, guys. You hear me okay, right? So Dave, I have a question on...

(technical difficulty)

Yes. John, you're breaking up. We can't hear you. Amanda, let's go to the next question, please. John, we'll come back to you.

You next question comes from the line of Adam Holt from MoffettNathanson.

It's good to be back on a Splunk call.

Welcome back, Adam.

I guess I have a follow-up to Phil's question. The fourth quarter, you look at your 44% billings, the comp was a little bit easier but still tough, and a lot of large deal activity. Do you think what you saw there was really a Q4 phenomenon on the larger deals and the billing strength? Or has the momentum of the business really inflected on the back of some of the changes that you made in sales and as you look into the next couple of quarters around both large deals and just in general, the billings momentum?

I think as -- I think Dave and I were ham and egg-ing, or whatever you say, back and forth on new versus adoption. The yin and yang that Susan's been dealing with and that I had to deal with as well as the head of field, was how do you deploy effective resources across existing accounts as well as make sure that you're striping more greenfield opportunities well enough. And I think there's a lot of good balancing that we did in this past fiscal '18 that we further leaned in on and striped the field for FY '19 to make sure that where we have a good propensity to buy a set of indicators, that we're reducing the number of accounts that those reps -- the rep to account ratio so that we can help the accounts with that use case virality across the -- their organization. And -- but the more surgical approach, continue to add more of the commercial and what we call field, kind of the $2 billion and below, $3 billion and below, territories. Enough resource there with the increasing investments and demand gen and some of the products initiatives so that those commercial and net new greenfield accounts get their volume as well. And I think 7 -- a lot -- those 8-figure deals and overall volume at 7-figure is both a better understanding of the customers on what Splunk can do. But to help guide that understanding, you need enough time and attention from the go-to-market teams with that account.

And Adam -- no, I was just going to say that to your point about fourth quarter momentum, I mean, as you would expect, our fourth quarter is our seasonally largest. And many of our largest transactions occur in the fourth quarter. But we had good representation in terms of 7-figure orders across all 4 quarters of the year. Now you might recall on the last call, we talked about 2 of our largest cloud orders closed in our history, and that was Q3. So it's not just some massive inflection because it's the fourth quarter, we're seeing these types of adoption transactions occur broadly and both domestically and abroad.

And if I could just -- that's terrific. If I could just ask one question on the guidance. So get the point on durations around -- and the impact on cash flow, but as we look at the potential top line momentum versus the guide for cash flow, which looks like, call it, 14%, 15% growth, is that the only factor that's driving a little bit slower cash flow? Or are there other factors that we should be considering as we think about the mechanics of next year?

Yes, you bet, Adam. The cash flow is a derivative of the duration -- the billings duration. So there's 2 elements that I mentioned in the prepared remarks. One was we expect duration to ease down as the pool gets larger. And again, the typical behavior for customers under a subscription contract is to pay annually. The other is that as we get to higher levels of subscription, unless the duration, in fact, elongates, the size of the contracts is actually smaller than a perpetual. So both of those impact our outlook as it relates to fiscal '19 cash flow, which we think is, again, part and parcel to the transition from primarily on-prem perpetual to the primarily subscription.

Your next question comes from the line of Abhey Lamba from Mizuho Securities.

Doug, you talked about some of the product changes you're making to increase net new customer additions. How about on the go-to-market side? As you're going into fiscal '19 comp plans, are you doing some things in that to escalate that metric? Because 570 is, kind of year-over-year, down. And the last time you had anything kind of less than this was in, I think, fiscal '14. So just trying to see what are the other levers you're trying to pull to get that metric of net new customers to go up.

Yes, it's a multipronged approach. I think -- I still believe that coverage is the most important factor. The -- making sure that we are -- that both building a leadership team and bringing on the right types of people that know how to do much more of a transactional and new entry greenfield sell is critical but also lining up the partner and channel community and making sure that they have the right incentives to drive that behavior as well is key because, as Dave says over and over, and as we all have experienced, (inaudible) has experienced. I'm going to go wherever I can have the highest chance of making the most money, and current customers is where that exist. So the segmentation that Susan did in FY '18 allowed the beginnings of a much more aggressive build for our commercial segment. And the hiring rate and the investments we're making, continue to make in FY '19 on everything from the business development and sales development reps to the inside sales teams that would traditionally be allocated to that commercial segment, I think will be a good impact area for us in FY '19 and beyond.

Your next question comes from the line of Kirk Materne from Evercore ISI.

Just 2 quick ones, I guess, first for Doug. In terms of getting more leverage out of the channel and using the channel as more a force multiplier to help augment your own direct sales force, where do you think we are on that? And I guess, did you see signs of progress this year? And what is sort of your hope for 2018 on that front?

Yes. It's been -- it has been a continuous year journey to try and move from probably a channel-neutral to maybe slightly channel-negative company to one where the partner community actually -- where we are aligned with the partner community and we have enough proof points that they see it and believe it. This year was the first year that we really started to see a more universal positive response in the partner community, but that's after 2 years of continuous investments. Two years ago, we neutralized the landscape so that all reps were paid on partner activities, so we didn't have any type of -- so we could minimize the conflicts happening in the field. We started to invest in automation and had some really nice releases this year with our partner portals so that we had an effective deal reg. We've got now automated online marketing development funds that people can register for. We've got online training. We've had to ramp up all the partner enablement resources, partner technical resources that can help, with partners, get them to the right certification levels. And at .conf in September and then at this SKO that I literally just flew back from it midnight last night, I could really feel a very, very different tone from the partners. Last year, they were now beginning to really understand that we're serious. This year it's like, "I get it. The opportunity is enormous, and you guys are going to be consistent in your investments in the way that you interact with us." So it's a -- I'm feeling confident about the partner channel in a much more grounded way going into FY '19 and beyond.

Okay. And then just one quick one for Dave. Dave, if we sort of back out or normalize for the 606 adjustment, obviously, you don't seem that you're going through a ton of operating leverage this year. Obviously, I'm just trying to get a sense. But then when you look at fiscal '20 guidance that you sort of talked about, obviously, the operational leverage looks to ramp back up. Was it just an explicit decision on your guys' part to sort of maybe pull forward some investments into this year? Or is there something structural where you don't get as much this year but next year, from just a purely operational perspective, you get a little bit more of a ramp on op margin expansion?

Yes. No, it's really more around decision-making and where do we get the best ROI. And a lot of the commentary that we've been providing so far is around our appetite to continue to invest in the product offerings and the coverage. We have these initiatives around adoption, which is obviously bearing a lot of fruit. And we certainly think that we'd like to do better on the customer acquisition side, which is all about having the right go-to-market structure that Doug mentioned and then the right product portfolio to go address the needs of those customers. So we look at the implications from accounting. We built that into our outlook. We increased it to 11.5% from what we expected 3 months ago. And then as we project forward, we think we end up at the top end of what we had guided before, which is 12% to 14%. So all, to me, in a very disciplined and explicit approach in terms of what kind of results we want to deliver.

Your next question comes from the line of Nate Cunningham from Guggenheim.

Sounds like customers are getting more positive on the features and scalability of Splunk Cloud relative to your on-prem offering. And I was wondering if you could talk a little bit about what steps you've been taking to bring those 2 products to parity.

It's a good question, Nate. I'd actually flip that a little bit. Right now, the products are actually at parity. It's the same code that is in our cloud minus the automation and the other trimmings around it that people are getting on-prem. And what we've been working toward the past 1.5 years, and you'll start to see some continued cadence around this year, is to allow the cloud product to become much more cloud-oriented and everything from a continuous deployment approach, where we can update at any point in time like any cloud vendor, all the way through to the types of self-service and ease-of-use interfaces that you need in cloud, where you really can't and shouldn't get access to deep configuration, capability and a lot of command line type interface capabilities. So I think what we will see is a continued move on velocity and cloud-iness of our cloud offering that eventually we package and deliver back on-prem. And again, it's been -- like the other transitions we're working through, there's a lot of work we've been doing in the past 2 years that we can have that happen at the quality level and without disrupting our on-prem customers the way that we need to.

Your next question comes from the line of Michael Turits from Raymond James.

Let me just jump back into the cash flow questions. If we look from '19 into '20, at that point, is duration still going to be an overhang? Or should we have more steadiness in terms of the duration in that year and, therefore, a return to more normalized cash growth into '20?

Yes. Hey, Michael. I expect that as the pool of subscription contracts continues to grow, that it's -- the duration should ease down. We give a weighted duration and, obviously, some of our largest transactions are multiyear. So that's yet -- it will play out in terms of what duration is but, again, I expect it to ease down. I think the other element in terms of where do you get to like a normalized growth rate in cash flow is when we get to a change in terms of the transition to subscription that is less dramatic, meaning we're expecting to go from 50% subscription in fiscal '18 and jump to 65% and then 75%. So the change to subscription actually starts to slow in fiscal '20. And I think that then translates to a normalized level of cash flow growth.

Great, that's helpful. And then just one other cash flow question. In fiscal 3Q, you had -- collections are a little slow because the big deals end up -- you beat the heck out of billings, but cash flow a little less and DSOs still high. So are there any adjustments that you're making here in terms of collections given that these deals are bigger, maybe more back-end loaded? Or should we just have to wait now and a year later to catch up on DSOs and cash flow?

Yes, I think for it to normalize -- so obviously, the linearity of large orders has a big impact on DSO. And with as much momentum that we had around 7- and 8-figure orders in the quarter, those are typically going to close more so in the third month than they are in the first. So what you see as a result is an uptick in DSO. In terms of the health of the aging and collectibility, I mean it's as solid as I've ever seen. Our collections team is the best, and I don't have any concerns at all in terms of how the DSO moves from a seasonal perspective. I think if we were flatlining in terms of overall growth, then you'd get a flatline in DSO. But with continued momentum around these adoption transactions, that's the result. But in terms of the actual collection activity and are we going to catch up, in a way, I hope not because that means we flatlined on the growth. And we don't expect to flatline on the growth, so I think that's how it's going to play out over time.

Your next question comes from Fatima Boolani from UBS.

A question for you, Doug, to start. Doug, you spent a lot of time talking about Splunk Essentials. And I wanted to get a better sense of what the monetization angle there is, if there is one. And a follow-up for Dave.

Hey, Fatima, I just -- I didn't hear you say talking about -- and at that critical moment, you cut out.

The monetization and goal for Splunk Essentials. I mean is that...

Splunk Essentials.

Splunk Essentials, right.

Got it. Yes, thank you. I'm really enthusiastic about what we're doing with Splunk Essentials. So there's -- the way that we're looking at go-to-market for us and partners is there's 3 levels of investment to help customers on their journey with Splunk. The lowest -- the easiest level, the lowest hurdle rate is Splunk Essentials. And we've been -- Splunk Essentials is basically a pretty big use case that doesn't come with a full application, but it's all the detailed information you need with assistance or some technical interfaces that go with it, what data sources you need to go after, how they should be striped or handled if they need to be transformed in any way, what the schema looks like, what they've be stored in, what kind of visualizations surround them, what kind of ML routine should go with them, what kind of remediation should occur. The customer, by themselves or with a partner, still has to do the work to implement them. But given that you follow the recipe, you should have an effective and consistent outcome. And the goal there is a very wide aperture. They're generally [dated] to test them out. We started internally on how do we define these and start to scale them. But they're being opened up across Splunk and, over the course of this year, will be open to the partner and customer community. The layer above that is, what we call, Insights. And that's where Waitomo fits. And that's almost a submodule of what would be a premium solution like Enterprise Security or ITSI. So Project Waitomo is more focused on infrastructural monitoring, which is a -- almost a blade or a component of a broad-based systems monitoring piece that ITSI would be on top of. And the target there is much more managerial level, how do we -- and it should be smaller development teams, smaller level investment, very specific pain and use case. And then the top of the rung are these premium solutions where they become a little bit more broad-based, just probably 2 or 3 mission teams or agile teams to get them created and support them.

That makes a ton of sense. And Dave, a follow-up for you. Both of you have talked a lot in the prepared remarks around the incentive that you're putting into cloud adoption and customers increasingly adopting cloud. So I'm wondering what sort of the thought process is going into next year with cloud growth decelerating. I mean how should we sort of reconcile that with the momentum you're seeing with the cloud uptake and the incentives you're providing or the incentives that you're rolling out in your go-to-market to encourage that adoption? That's it for me.

Sure, Fatima. So from an incentive perspective, to me, that always translates back to how are we incenting the behavior of our field. And what we've really been working toward in that context is as much neutrality in the comp plan as possible to enable customers to have the vote. And for fiscal '19, we're leaning more on subscription from an incentive perspective ever so slightly, and striking that balance is always a challenge. I think from a growth rate perspective, the numbers are -- the growth rates are very large when you're talking about tens of millions of dollars, and then the growth rates get smaller when the numbers get bigger. So I don't -- I'm happy with what we've achieved in terms of cloud transactions and the cloud contribution in fiscal '18 and certainly looking forward to doing more and more cloud transactions going forward. But ultimately, we just want the customer to pick, like how do we serve them best.

Your next question comes from the line of Matt Hedberg from RBC Capital Markets.

It's Dan Bergstrom for Matt Hedberg. So both AWS and Palo Alto are good partners for you. You called out impressive AWS success on the call. But I'm wondering, could you comment on AWS' acquisition of SQuirreL and then Palo Alto's got good momentum from its new logging service? Ultimately, I guess, are these just complementary technologies and another source of data for you to ingest?

Yes. I would view them -- they're -- AWS' job is to continue to offer more and more services, both infrastructure and platform services, to the community. And our job is to keep adding more value on top of those services so that people would still want to do business with Splunk in addition to, or with, AWS. And that's just -- that's a game that we all know how to play in tech. It's the same game that people have got to play around the Cisco ecosystem or the Microsoft ecosystem or the Oracle ecosystem. So our focus every single day is to continue to drive more ease-of-use, more power, more capability on the discovery of data, the enrichment of data, the storage and manipulation of data, ultimately, by getting value out of the data and the execution of decisions around that data. And with AWS, we leverage their technology to help get that done as well as other complementary technologies. So the Kinesis integration is a great example. Kinesis is a great product, so is Kafka, so is Spark, so is Flink, we've got to be open to the whole lineup of different technologies that can help us on that journey of find, get and create meaningful action around data. And the same thing with Palo Alto. They, for sure, have got to be able to provide effective reporting and insight into the data that surrounds the Palo Alto fire -- the Palo Alto lineup, the Pal Alto tech lineup. We, I think, provide additional visibility around the Palo Alto data sources. But more importantly, Palo Alto is one. The average CSO has well over 70 technologies; most of them, well over 100 technologies in their landscape. And our ability to sit on top of that very diverse and very volatile landscape and be able to provide the visibility and the correlation and the insight, the actions across it is the value that we are driving. So integrating with Palo Alto is key to help the Palo Alto user. But we do -- we flow beyond that to make sure that we give the right security analytics and nerve center capabilities to the entire security and IT landscape.

Your next question comes from the line of Jesse Hulsing from Goldman Sachs.

I have 2. First for Doug, I guess, throughout the call, you've made a few references to changes to the sales org or tweaks to the sales org. I guess, how major or minor are those tweaks? I mean, were these big changes or small changes? And do you expect any impact to the first quarter? And then for Dave, for the first quarter under 606, what was revenue in fiscal '18? Was it -- can you disclose that so we can have a growth rate compare?

So the joy of being a high-growth company is that you are never done changing. So actually, the other core message at the SKO event we just had was the growth mindset and the learning mentality that you have to have if you want to be part of a high-growth company, and the field is no different. The job that Susan and her teams have is to continuously lean forward and make sure that, in all avenues, direct sales, partner, customer success, proserve, pre-sales, that would make whatever tweaks you need to make every month and every quarter and every year so that we can address the opportunity with our customers. Obviously, Feb 1 for us is a bigger opportunity to make changes. And it depends region-wise within our landscape what Susan focused on because each theater is at a different stage of both maturity and customer growth. And -- but there were changes made to each theater as it were last year and the year before to make sure that we can provide the right segmentation and focus on existing and new customers to move both those dials forward. I'd say that the changes this year were less of a magnitude than last year but still were a material set of changes to make sure that we're taking the right lean-forward approach to sustain growth for FY '19 and beyond.

Yes. Hey, it's Dave. So on a preliminary basis, our current estimate for Q1 of prior year under 606 is about two and a quarter million, so $225 million.

Your next question comes from the line of Alex Zukin from Piper Jaffrey.

This is Taylor Reiners on for Alex. I wanted to dig in a little bit on international. It looks like your international business significantly accelerated during the quarter. I know you called out some challenges in Europe earlier in the year. And I was wondering what drove that recovery, especially while you were still searching for a VP of sales in the region? And then looking to 2019, what are some of the Richard Timperlake's priorities as he moves into the new seat?

Yes. Incredibly proud of our international teams, and especially the EMEA team for their ability to dig in, focus and not let any of the distractions get in the way. As we talked about in the past couple of quarters, Susan was the de facto head of Europe, but we have a COO over there that came from the Eastern region before we made any changes, before the Q1 issue, who was the key right-hand person to make sure that -- there was a combination of Susan and the really strong ADP level of leadership across EMEA are kept on track. I think the progress that we made at the second half of last year -- second half of FY '17 and in FY '18, principally around the building and hiring of that ADP level, the sub-theater heads, North, South, Central, emerging markets, et cetera, U.K., that we had strong leadership in place and that those leaders built out the right first level and implemented the right operating cadence within those different theaters. What I think we saw and why -- our guidance in Q1 is we're making this change. But hang tight because I'm not so sure that it's as dramatic as it appears because I think we've got a really strong ADP sub-theater management team there. What we saw in Q2, Q3, Q4 was exactly that. Really, really proud of that team. And I think Susan's overall top-level leadership, operational cadence and strategic orientation within that region, combined with the COO of that region, did a really, really effective job of making sure that we kept the ball moving forward. So I think Richard inherits a very, very mature and solid foundation. He, however, still has got the same challenge as the head of Americas, the head of APAC and Pub Sec, which is we got a big year in front of us. There's a lot of key initiatives that we got to drive. He's got to continue to bring in top, top talent. He's got to make sure that we -- he continues to grow the talent that we have. He's going to lean forward for -- with the term orientation and the right deal structuring and customer adoption services. There's a lot of good momentum that we've driven across EMEA on this commercial segment, in the VDR/SDR segment. We continue to focus hard there. And EMEA tends to be one of our better partner-driven areas as well but continue to double down on the partner contribution and the true strategic leverage of the partner channel. And I think our APAC leader, Boey, has got a similar set of cadence for this year as well.

Excellent. And then maybe just a quick operational follow-up. Some of our similar conversations with partners as well as a lot of the logos you called out suggest that you've seen a really strong performance out of your state, local and education team. I was wondering is there a similar opportunity to accelerate adoption within other verticals? And if so, what are some of the changes you're looking to make to the sales organization to go after those -- some of those opportunities?

Yes, it's a great follow-on question because we -- there's a lot of talk that we have and a lot of focus on customer size segmentation. But I think that there is also huge opportunity in the verticalization approach as well. And pub sec, federal government, state, local and education in the U.S. has been a really successful segment for us. We have mirrored that approach in a couple of our more mature regions, U.K., Australia being 2 good examples. And so we will continue to roll those out to the markets where there's enough maturity, momentum and critical mass that we can afford that verticalization. And then Susan and the team continue to look at other top-tier segments that have strong momentum with Splunk and some uniqueness. And the areas we've talked about for a while, and we actually have a very decent rep dedication, too, just not from more a management infrastructure. It's financial services, telecommunications and, increasingly, health care and manufacturing as IoT come on the scene. But for now, we're taking a nonformal organizational approach for those just given the overhead that comes with casting any formal field architecture there.

Yes. And hey, Taylor, it's Dave. I really think it's part and parcel to our philosophy around investing in our coverage and our overall go-to-market to make sure we've got the right geographic coverage then the right segment coverage. And then, additionally, given the very specific verticalization just requires more critical mass in the field. There's great opportunities for us to leverage the repeatability of what we might do in transportation or in retail or in health care or in telco. It's just work to get there. So that's certainly something that is on our GTM road map, and we'll go attack it judiciously as you would expect.

Your last question comes from the line of Brad Reback from Stifel.

Hopefully, a pretty quick one. Dave, do you happen to have the backlog under 606 historically?

We don't have that disclosure now. We'll certainly be looking at that when we get later in the year and we're reporting on the 606 numbers.

Okay. Amanda, I'll wrap it up. Thank you for your help today. And thanks, everybody, for your participation. We're around here later tonight if you have any clarifying questions. Thanks, and have a good evening.

Ladies and gentlemen, this does conclude today's conference. Thank you, and have a wonderful day. You may now disconnect.