Splunk Inc (SPLK) 2019 Q1 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the Splunk Inc. First Quarter 2019 Financial Results Conference Call. (Operator Instructions) As a reminder, this conference is being recorded. I would now like to introduce your host for today's conference, Mr. Ken Tinsley, Corporate Treasurer and Vice President of Investor Relations. Sir, you may begin.

Great. Thank you, Bruce, and thanks -- good afternoon, everyone. Thanks for joining me. With me on the call are Doug Merritt and Dave Conte. We issued a press release after close of market today, and it is posted on our website. Additionally, this conference call is being broadcast live via webcast. And following the call, an audio replay will be available on the website.

On this call, we will be making forward-looking statements, including financial guidance and expectations, including our forecast for our second quarter and full year fiscal 2019 and our expectations for fiscal 2020. Trends and expectations regarding partners, customers, markets, strategies and deal size, as well as trends and expectations regarding revenue mix, planned investments and trends and our operating model resulting from our investments and our expectations regarding our acquisitions, products and technologies. These statements reflect our best judgment based on factors currently known to us and actual events or results may differ materially. Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements.

These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures, which are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.

So with that, let me turn it over to Doug.

Thank you, Ken. Hello, everyone, and welcome to the call. Q1 was a solid start to the year in terms of both field execution and product innovation. We delivered a $312 million in total revenue, up 37% over last year. We also announced a series of product developments that expand the capabilities of our portfolio.

At the recent RSA conference, I had the opportunity to meet with many of our customers and partners. What came out of our discussions is a continued validation of Splunk's role as a nerve center for security and the importance that our platform and solutions bring to CSOs, CIOs and their teams through Splunk's ability to leverage their data no matter where it's sitting, in the cloud, on-prem or both and has simultaneously used that data to solve a variety of use cases in security, ITOps and DevOps.

Throughout Q1, we received overwhelmingly positive feedback on the Phantom acquisition, which will enable us to leverage orchestration and automation capabilities in security and other use cases like IT. For example, imagine Splunk's IT Service Intelligence predicting an outage. It can trigger Phantom to provision or reboot really troublesome servers and avoid an issue or use one of our many integrations such as automatically issuing a ServiceNow ticket.

Building an analytics-based, self-healing cloud is just one of the many possibilities. A customer who recently began using Phantom has changed health care. They turned to Phantom to help them address integration needs related to the recent joint venture, which doubled the company's servers and networks. As a result, they expect a large increase in the amount of security data they ingest.

Phantom will allow change health care to contain costs by orchestrating playbooks and automating many steps at the investigation process without requiring significantly new resources. We will continually lean forward on our build-buy partner strategy to deliver value to our customers and accelerate our innovation. I'm pleased with how the integration is going, and we were excited to welcome Oliver, Sourabh and the Phantom team as they move into our Bay area offices last month.

As I covered at a recent Analyst Day, we're early in a large and growing market when you consider the significant growth in the amount of data being generated. And Splunk is all about helping customers extract more meaningful insights from that data.

During Q1, we rolled out new products and solutions that are helping us address our market opportunity. We announced a limited availability release of Splunk industrial asset intelligence, our first packaged IoT solution targeted at industrial companies. Our solution delivers real-time monitoring and analytics to help automation and process engineers identify and diagnose issues, enabling improved availability and performance of their operating environments. We've been working with beta customers, including Shaw Industries, who adopted Splunk to implement real-time factory floor analytics, given them insights in uptime, quality and production metrics.

For IT ops, we introduced Splunk Insights for infrastructure as our new monitoring solution that runs automated investigations on IT infrastructure. With SII, customers are able to surface trends and identify root cause faster and easier. This new solution, formerly known as Project Waitomo, collects and analyzes both metrics and logs, making monitoring and troubleshooting seamless. Systems administrators and DevOp teams can get up and running in minutes and can start monitoring smaller environments for free. When they're ready to increase usage, we chose storage capacity as our pricing metric to make it easy to expand and to align with our customer's value.

We also expanded artificial intelligence capabilities across our product portfolio. With the latest release of Splunk ITSI, customers can use AI to help prevent outages through predictive analysis of service health.

Splunk UBA features new machine learning models, enabling customers to identify and address time-sensitive security problems and insider threats more quickly. The latest release of Splunk Cloud and Splunk Enterprise added enhancements to our free Machine Learning Toolkit, making it easier to view, control, evaluate and monitor the status of ML experiments.

One thing that's becoming increasingly apparent is that Splunk and just about any other technology in the ecosystem provides better results for our customers.

As I've highlighted a number of times, we're intent on providing an open data platform for our customers. We've expanded this area, adding integration with Open Source and cloud native technologies, including Apache Kafka, (inaudible) and Docker. With these releases, Splunk customers are better-positioned to make sense their data, to search, to monitor and alert on that data in real-time and to predict future IT security and business outcomes.

It's increasingly apparent that Splunk's platform is the best solution to enable customers to harness these data sets to gain operational intelligence by asking different questions to the same data across multiple use cases.

In Q1, we saw a continued momentum with our customers, both in our Splunk platform and aligned with our market group focus.

Starting with ITOps and app delivery. Wins in the quarter include in the University of North Carolina, Charlotte, who is already a Splunk security customer and upgraded their use of Splunk Enterprise to improve uptime for their student information and learning management systems; and a large federal agency who expanded their use of Splunk Enterprise and ITSI to improve the stability and availability of its online citizen services portal. With Splunk, this agency can easily correlate data from multiple data centers, both on premises and in the cloud, in order to provide a single cohesive view of their complex environment.

Moving to security, where we continue to help our customers migrate from a structured legacy SIM to an analytics-based approach. Notable security wins include the University of Alabama Birmingham Medical Center, who expanded their use of Splunk ES to replace a legacy SIM. Splunk will sit of the heart of the hospital's new security operation center to better identify and defend against threats; and Relatively, who's a new Splunk Cloud and ES customer -- the eDiscovery software company chose Splunk to better identify security threats and address customer needs to scale.

Highlighting a handful of customers went all in and (inaudible) some Splunk as their machine data platform. On G, a multinational utility company based in France, is expanding their use of Splunk Enterprise to include new use cases to monitor On G's own IoT applications and end-to-end monitoring of the IT stack. This enriches numerous existing use cases, including security, AWS Cloud Monitoring and Dev ops.

Telco and Internet services provider, 3 U.K., expanded their use of Splunk Enterprise to support a major business transformation project designed to establish the company as the best-loved brand by customers and people. Splunk will help the GDPR compliance, streamline operations and improve customer satisfaction. We also saw our cloud business continues momentum. A sampling of our cloud wins in the quarter include Canadian insurance company, The Cooperators, an existing Splunk on-prem customer, who chose Splunk Cloud to further improve their security posture and IT infrastructure.

The U.K.s together financial services replaced the legacy SIM with Splunk Cloud and ES because of Splunk's ability to be a single platform across security and IT. Thanks to our partner, Summerford, for their help on this win.

Australia's Latrobe University purchased Splunk Cloud to advance their smart campus vision and get a better understanding of their facilities utilization, including lecture theaters, libraries, student cafés and restaurants.

Moving on to the ecosystem. We expanded our relationship with Accenture, bringing Splunk, among other technologies, into the Accenture cybersecurity engine. By seamlessly integrating leading security software solutions on a single cloud-based platform, their solution gives organizations the power to detect, investigate and respond more quickly and effectively to cyber threats. This is another example of our partner ecosystem adopting Splunk technologies and underscores our continued leadership in the SIM market.

We're also continuing to build on our partnership with AWS, recently announcing Splunk Insights for AWS Cloud Monitoring in a pay-as-you-go model on AWS marketplace. This gives our customers even more flexibility on how they use Splunk and AWS together. And our AWS app, which helps customers get more value from their AWS data, remains one of the most popular and top downloaded apps on Splunkbase.

As you know, customer success is our #1 company priority, and that focus has helped us build a great team and culture. I am very happy that Splunk is again named One of the Best Places to Work in the Bay Area for the 11th consecutive year as well as winning similar awards in Europe and Asia. These recognitions are a testament to our people and their commitment to our customers and our partners.

In summary, it was a solid quarter and start to our fiscal '19. I'm proud to the entire Splunk team. We're uniquely positioned to capture the tremendous opportunity in front of us, and we are pursuing it aggressively. We're early in our journey and are investing for scale and growth. We're delivering high value to our customers, who are expanding their adoptions of Splunk as their platform for machine data analytics, both on-prem and in the cloud.

Again, thanks to all of our customers and partners and thanks to all of our awesome Splunkers.

Now let's turn the call over to our CFO, Dave Conte.

All right. Thanks, Doug. Good afternoon, everyone. Thanks for joining the call. I'm pleased to report a strong first quarter and solid start to the year.

First quarter revenues were $312 million, a 37% increase over Q1 of last year on a 606 basis both years. Cloud revenue was $34 million, up 89% over last year. Q1 software revenues, which is the total of license and cloud, were $173 million, up 43%. Education and professional services represented 10% of total revenues. International operations contributed 27% of total Q1 revenues. And we added over 6 -- 460 new customers and recorded nearly 400 6-figure orders.

Historically, we've provided the 6-figure order metric as an indicator of our growing adoption within our customer base. Related to this, we've also provided greater than 7-figure orders annually as an indication of our #1 initiative of customer success.

Starting with this report going forward, we will provide orders greater than $1 million instead of $100,000. To that end, in Q1, we recorded 43 orders of $1 million or more, which compares to $35 million in Q1 of last year.

Overall, our growing product suite, complemented by increased awareness and compelling value prop, continue to drive broad and large-scale adoption.

Now turning to profitability and other results, which are all non-GAAP and on a 606 basis, including all the comparables. Q1 overall gross margin was 79%, comparable on a year-over-year basis. Operating loss was $14.7 million, representing a margin of a negative 4.7%, slightly better than our outlook, driven by our solid top-line performance.

Net loss was $9.4 million or $0.07 per share using a weighted average share count of 143.5 million shares. Operating cash flow for Q1 was $77 million, while free cash flow was $74 million. We also ended the period with almost $1 billion in cash and investments, which is after the cash payment for the Phantom acquisition.

Now turning to the balance sheet. Again, note that all values have been recast in their entirety following our full retrospective adoption of 606. Accordingly, you can now see the impact of the accounting change on deferred revenues, which we detailed at our analyst meeting in March.

As a further heads up, starting with our 10-Q, with our first quarter results, you'll see a new disclosure required by 606 called Remaining Performance Obligation or RPO. Simply, RPO is the aggregate of deferred revenue and backlog and totaled $765 million as of April 30. And this compares to about $800 million as of January 31.

Now turning to guidance. We expect Q2 revenues of between $356 million and $358 million and a non-GAAP operating margin of a positive 2%. For the full year, we're now expecting total revenues of approximately $1.645 billion, up from $1.625 billion, and we maintain our non-GAAP op margin target of 11.5%.

It's important to note that the expense run rate we assumed with the Phantom acquisition is incorporated into our margin guide. Since we expect to be non-GAAP profitable for the remaining quarters of this year, please remember to use a fully diluted weighted average share count for your EPS calculations.

Now as we continue to scale and drive toward our goal of $2 billion of revenue in fiscal '20, we're eager to expand the capabilities of our service partners. Specifically, we have focused important parts of our customer success organization toward partner enablement and the expansion of their service delivery capabilities. This is a critical element toward ensuring our customers have the best resources available to aid them on their Splunk adoption journey.

To that end, we expect that, over time, partners will deliver more services and take the related revenue directly versus our own delivery teams and revenue on our P&L. We all know this trend is not new in our industry, and it helps drive increased valued that customers derive from their data.

Now historically, PS and ED revenues have ranged between 5% and 10% of total revenues. The shift to greater partner service delivery will result in our PS and ED revenue moving away from the top end of this range over time.

In closing, we're off to a good start for the year. Our product investments are driving customer success, and our field expansion is enhancing our overall execution capability. Our strategy working well, and we continue to feel the pace of adoption as we drive to make Splunk the standard for machine data analytics.

Thanks much for the time and interest. With that, we'll open it up for questions.

(Operator Instructions) And our first question comes from the line of Kash Rangan from Bank of America Merrill Lynch.

Can you just, Dave, recap for us how we should be looking at billings in the context of the shift towards a 606, that's number one? When I do some quick math, it looks like the backlog, which is the aggregate of deferred revenue, I guess, it matched back. But the number $765 million that you disclosed, right, back out the deferred revenue, it looks the backlog grew substantially. Can you just talk more about that? And then finally, the speed just calculating your billings to be one just reported. I know it's less and less relevant, but just to set the record straight, if you had [AC6] comparable billings from a year earlier, what would that growth rate have looked like for an apples-to-apples basis?

Yes, thanks, Kash. And I do miss the (inaudible) as part of your question, so we'll get that for next quarter.

I'll come back.

We'll come back to that. Well, so there were probably 3 or 4 questions I wrote into that, so let me see if I can knock them down. First of all, you're right. We no longer provide billings guidance, and we suspended that along with the many others in the software industry because under 606, it's just a less-relevant metric. You have revenue that is being recognized in the income statement that actually is unbilled. And when we think about, well, what's a better or perhaps more relevant metric that we will be providing, it's really the remaining performance obligations. So we really wanted to establish a baseline to say, "Hey, listen, Q1, it was $765 million that compares after our seasonally strongest fourth quarter with about $800 million." We're not guiding to that yet, but we think over the balance of the year, as 606 becomes -- as we all become more acclimated to how that flows through the financial statements, we'll be able to look at that metric in terms of better guide in terms of -- instead of billings. I think the bigger impact you're seeing, "hey, what would have been if it was 605?" So I'll just declare for all the questions that are coming, 605 is end of life. It has been fully retired. We worked extremely hard to provide 4 years of comparability under 606. And everything that we talk about is 606. With that, probably one of the elements, just to remember, we are consciously moving more and more to subscription. And last year, we were at roughly just about 50% subscription, and we have an objective to accelerate to get to 65%. And when you look at overall yield in the financial statements, whether it's the balance sheet, whether it's the income statement or even the RPO disclosure, the impact of having greater and greater amounts of subscription is tied directly to the duration of those contracts. We have been moving toward -- it's been 2 years on average for the quarter. It was slightly above that. But without duration being equal to 36 months, you're going to have a different overall contract value yield that fits into all of those categories. So that's very consistent with the guidance that I've provided on the fourth quarter around how to think about cash flow for fiscal '19. As we move more and more to subscription, you have -- the duration is shorter, but also customers have the tendency to be billed annually. So really, if you're thinking about, well, how do I understand billings under 605 versus 606? Forget 605. Billings isn't the right metric. But we're really moving from 50% to 65% subscription.

And our next question comes from the line of Michael Turits from Raymond James.

Two questions. One, I'd like to come back to the old topic of pricing and whether or not there's any change in the way in which some of your competitors are being aggressive or not on pricing and pushback from if there's any -- if that's changed in any way from customers and whether or not there's any plans to adapt pricing plans in any way to that. And then I have an accounting question.

Hey, Michael. So as we just said, it was something like Splunk Insights for infrastructure. And as we're at Ransom, we're continuing to roll out different solutions and/or different cuts to Splunk that have different pricing metrics. The SII app is based on amount of stored data, not ingested data. Ransomware is based on number of monitored users or number of active users. Our strategy is to, yes, continue to offer different capabilities, and make sure that we're pricing them in a way that makes sense based on the value delivered and what other categories or tools that are similar, how they price as well. What I have seen with customers is a better awareness of term options, enterprise, adoption options and other mechanisms that we've rolled out that help our customers feel like they've got predictive spend with Splunk instead of some of the challenges that we've all talked about on the -- like you could be the mercy of bursts of data and what that could do to any type of quarterly spend on Splunk. So -- but I've seen a continued slowed decrease in some of the energy around pricing. But I think that, that would be accelerated as we continue to have more packaged offerings and different cuts of Splunk that get away from some of the more variable piece that would have to come in through Splunk.

Okay. And then, Dave, accounting question. I'm pretty sure this comes out in the queue, but it may have been buried somewhere. I didn't see a lot of numbers out there. But do we have the deferred revenue number for 1Q '18? So a year ago on a 606 basis because we're on 606 now?

We do not have a balance sheet out of 1Q as of fiscal '18, no.

Okay. Do we get that in the Q?

I don't think that comes in the Q. Like, the Q is going to have the year-end balance sheet compared to the Q1 balance sheet, similar to the table in the press release, yes.

And our next question comes from the line of Phil Winslow from Wells Fargo.

I just wanted to hone in after your comment, Dave, just large deals this quarter. Obviously, you're seeing just a continued trend there, not just this quarter, but over the past couple of years. So a question about you and Doug and just in terms of just a focus on, call it, larger deals through existing customers versus net new customers. Obviously, you've got to focus on both. But can you just give us sort of an update on sort of where you think sort of the sales force is and balancing those because, obviously, you're -- it's getting very well on the big deal side.

Yes, there's a -- well, when I look across the initiatives of the company, there's 2 that are really important that actually fit into exactly the questions just asked. One is getting increased adoption across our accounts, and that's where you see ASPs go up, size of deals go up, and that's that whole land adopt-expand-renew type of motion within accounts. And the other is higher transactional volume and higher focus on net new customers.

As we've talked about, we are continuing to make a whole series of investments to ensure that we're moving that net new needle up. But we also do not want to lose our focus on the overall traction, excitement and commitment that customers have as we're seeing more and more value from Splunk within their current accounts. So it's -- they're literally initiative #2 and #3. They almost like 2.1 and 2.2 because they're virtually tied as far as overall importance on the cohort and business models that we're driving.

Yes. Hey, Phil, it's Dave. I think if you reckon back to a lot of the discussion we had at Analyst Day in March, both from a product delivery perspective -- I'm sorry, the product capabilities delivery both on-prem and in the cloud, and then all the work that Susan is doing, all of those tied together around the #1 priority, customer success. We see, as you point out, correctly large orders that are strong indications of adoption and how we're driving in that, but also how we're deploying our resources to continue to grow the overall flow of customers. We've laid out a mile marker of 20,000 by the end of fiscal '20, and we're tracking to that target.

And our next question is from the line of Raimo Lenschow from Barclays.

Dave, 2 questions for me. First one for Dave. Since you say RPO is the one I should track, are you going to give us -- or what's the best way to look at it? Is the year-over-year number the best way? And conceptually, I would say so. But then are you going -- I didn't hear that you talked about [June] in Q1? Or should we just wait to Q2 then? And then the second question for Doug is on -- if you run off your services a little bit more, I mean, you are not services-heavy. Can you talk a little bit about the incentive structure partners have in terms of multiplier they're making on your revenue? Remember, exactly we're at SAP, and there was like a 4 to 6x multiplier. What's the story for you? And what's incentives on the partner side?

It's Dave. Thank you for your question, and I think it's consistent with Michael and what's the balance sheet under a year ago under 606, which is a tremendous amount of work to get there, as you can well imagine. I think the best way to think about it, and we were conscious to try to give the sequential comparatives that really shows the seasonality and the impact on the RPO number. And all I can ask is for some patience as this metric develops and matures over the balance of the year. I think we'll all collectively figure out the best way to interpret it. But today, I think it's sequentially.

And Raimo, on the services and overall incentives for the sales force. As we've been talking about, we have, year-by-year, been continuing to augment the commission plan so that perpetual is at least on par with and/or eventually, it has a triple plays versus term and cloud. And I think this year, we made additional strides to ensure that our reps would be very interested and present interim in cloud so that we get the right type of movement and behavior that we're driving for our business model shift overall. Services is -- has a commission stream to it, but is not something that we are emphasizing with the reps. Our focus is on software revenue and software revenue growth, and that's the core health of our business. What Dave talked through around the shifts we're making as far as trying to get our partners to continue to step up on services delivery, this goes back to both success and empowerment of our partner ecosystem. And services is one of those core areas that they are very interested and focused on as well as coverage and reach. How do we have more people that understand Splunk, know Splunk or telling the Splunk story and are working with us to drive customer success. And what we've heard loud and clear from our partners and actually fits in with our focus on software revenue is let's continue to build and empower and educate customers on different implementation and success services so that they can help us carry the [balance] on those accounts.

And our next question comes from the line of Anne Meisner from Susquehanna.

Doug, quick one for you. I just wanted to circle back to last year's user conference. You unveiled the metrics functionality. And I'm just wondering if you can update as there and what kind of response you're seeing in the customer base and whether you're seeing sort of new use cases being enabled for that since I do believe it was something that customers were asking for.

Thanks, Anne. It's not so much new use cases, although Splunk Insights for Infrastructure really leans on that metric's capability. Customers were driving metrics by doing queries and -- which is very taxing on an infrastructure basis to create schema on the read that would then do different aggregations so they could actually get some type of sampling cost order metrics. The rollout of the metric store as part of the index and all the both infrastructure decreasing costs as well as the rapid increase in response time and capability was to make sure that you're using the technology for the -- for their use case that was architected or driven to serve. So what we had seen is customers really wanted to monitor, detect and investigate from one framework. And the metrics index is a move to say, "You're doing that -- let's hope you do that in a more elegant and more cost-efficient and quicker-response-time basis." What I think you'll see in the coming 12 to 18 months is continued aggressive lean-in on more alternatives to get even more real-time, even more capable and as far as size and results set by leveraging the data fabric orientation of Splunk and the capabilities of a lot of different technologies that exist around us.

Very helpful. And just a quick follow-up for Dave on the performance obligation. Thanks for disclosing that. It looks like $139 million, roughly, is off balance sheet backlog. Given the fact that you expect the trend toward annual invoicing, I assume that number, the off-balance-sheet backlog, should then grew much faster than total backlog. Is that a fair assumption?

I think the challenge on that and is -- there's a difference between what is the remaining performance obligation and what is invoiced? Again, on a term contract, the revenue can be on the face of the income statement even if the invoice hasn't gone out. So the backlog isn't purely on billed amounts. It's remaining performance to be performed i.e. additional revenue to be recognized, which is why it's a combination of deferred revenue and backlog.

And our next question comes from the line of Alex Zukin from Piper Jeffrey.

This is Taylor Reiners, on for Alex. So I was wondering if you can give us an update around kind of the early cost-selling opportunities you've been seeing with Phantom and how you're looking at that ramping throughout the year. And then maybe any changes you plan to make to the Phantom sales organization over the next year?

Thanks, Taylor. It's a little bit early to really have enough of a bead on the cross-sell impact. The -- what I definitively have seen is incredibly high level of interest, energy and excitement around what the orchestration automation capabilities that Phantom brings to the underlying Splunk platform as well as the overall security use cases. Yes, I'd -- we all see that security spending continues to increase. The problems faced by anyone that's involved in cybersecurity continue to grow. And we already have -- are the establish leader in security analytics. What we've been focused on with Phantom is adding to the orchestration and automation capabilities that we launched to risk initially with the Adaptor (sic) [Adaptive] Response Initiative so that we can increase the learning and visibility into how the loop was closed when a key insight, driven by the analytics platform, is actually executed on behalf of our customers. And that's what, I think, the customer base is responding to.

Got it. And then just a quick follow-up. I was wondering, are you seeing any opportunity to extend the -- extend Phantom's capabilities to the operations side of the house in terms of orchestration and automation?

Absolutely. The way I've described Phantom is there's 2 elements to what we are excited about. One is, all the security content that Phantom had focused on to ensure that there were effective playbooks in automation for security-related incidents, and I'd put that more in the security market group content bucket. But the other piece, which I think is equally or possibly even more exciting, is the orchestration and automation capabilities on the platform layer that any of our market groups, ITOA, IoT, business analytics, can leverage and our beginning to leverage. But just as importantly, the hundreds of thousands of custom apps that our customers create, giving them the ability to tap into that as well.

And our next question comes from the line of Brian White from Monness, Crespi.

I'm wondering, Dave, if you could walk through a little bit on the second quarter operating margin. It looks a little bit lighter than, I know, that we are modeling, and I think The Street, but you kept your annual operating margin. So is this simply the impact of integrating Phantom? Or is there something more?

Well, I think there's 2 elements, Brian. You might recall, we spent a fair amount of time over the balance of the second half of last year in the A Day, talking about how the seasonality changes under 606, both from a revenue and expense perspective. And I -- so I think what we've said is, hey, most of that is Q1, and I think you've seen that impact. But it was really a change in the first half, second half. So that's one element. The second element is we did embed the expenses from Phantom for a full quarter into Q2. So it's really the combination.

Okay, great. And on Phantom, do you feel like this just strengthens your position in the security market in the products that you have? Or does this really open up a new TAM for Splunk?

A little bit of both. The new TAM is not enormous at this point in time. It's an evolving category. This orchestration-automation category. But there is meaningful value that customers are looking for and why I think that category overall has gotten a lot of excitement. I think the core that we are looking at is what do you think about the full life cycle of effective analytics. The final stage is being able to take action and understanding the efficacy and overall effectiveness of that set of actions so that you can take advantage of the insights that you've gotten from the other stages of that data pipeline. And Phantom and Red Bull organic initiatives are part of the key to making sure we've got a strong fourth pillar on closing the loop, especially on more of an automated ML system-driven approach while still integrating with the other technologies that need to do additional actions to ensure that our customer is protected in the security case or remediated in ITOps case or effectively manage in a IoT manufacturing floor operations case.

Okay. Just for Doug. Big picture, on the Cambridge Analytica fiasco, has that had an impact on your customers and how they're thinking about big data?

No. I mean, I -- good question. This -- the last 2 years have really had a lot of visibility, and GDPR has probably got more fans there in our world than Cambridge has. But people are definitely more and more aware of and thoughtful on the obligations that they have on protecting data. Where I think Splunk really comes into play is we can provide a lot of visibility for organizations on what is happening to their data as well as drawing insights out of that data for a better decision-making.

And our next question comes from the line of Fatima Boolani from UBS.

I just wanted to revisit the professional services discussion that you had earlier, and I'm curious about the gross margin implication. Do you kind of pass off more business to partners? Should we expect a release in the margin on the gross margin line? And a couple of follow-ups, if I may.

Yes, I -- Fatima, it's Dave. I think the margin impact, again, this is a longer-term trend where we're driving. And in fact, as we utilize some of our customer success organization to enable partners, we'll probably -- that standalone P&L may have a little bit of like to it from a margin perspective. But from an overall contribution to the bottom line, those impacts are going to be kind of de minimis, in my opinion. But we're really thinking about broad enablement, an ecosystem of partners, not just direct sellers that can engage with our customers to get more successful with the software. That's really strategically important to us. But from a margin profile perspective, I just -- I don't think there's enough math there to anticipate either a benefit or a detriment.

Fair enough. And maybe a question for Doug. In your prepared remarks, there's maybe more case studies as an example of IT operations use cases this time around versus security that kind of takes the cake as we think about prior calls. I'm curious on your perspective on where we are in terms of the scale, maturity and market awareness for your ITOps use cases, especially, vis-à-vis, security, which feels like it's more on cruise control?

Yes. It's so ironic because we started, as you guys know, in IT operations. And because of the urgency, boardroom visibility and all the other factors in and around security, that definitely has taken center stage, which we're super, super happy about, and obviously, benefit from. But the needs within the broader ITOps, AppDev, DevOps, clouds ops world continue to be challenging for organizations. And I'm really excited about the roadmap that we have over the next 12 and 18 months that you'll see increasing drops around to help all the constituencies on that infrastructural side of life, from developers all the way to IT operations, get better visibility, predictability, quality in a really turbulent landscape. The cloud has, I think, only increased the complexity given the micro-services, the more ephemeral nature, the speed and often difficult visibility that comes with those types of deployments in addition to the pretty complex on-prem data centers that folks have to manage as well. (inaudible) really, there's 2.

If I can make a quick one in for Dave. Dave, with respect to the $1 million deals that you're now going to provide every quarter, should we read that as coincident with higher EAA volumes that you're seeing? I know in the past, you've explicitly said that million-dollar deals don't necessarily equate to EAA, but I'm curious if that relationship has changed or is changing? And that's it for me.

It's a fair question. I think the relationship is the same. It's important for everyone to, as Fatima, you appropriately point out, 7-figure transactions are not synonymous with EAAs and EAAs are a subset of those numbers. So that relationship isn't changing at this point.

And our next question comes from the line of Abhey Lamba from Mizuho Securities.

Dave, when we look at the net new customer relations in the quarter, that was down year-over-year for the third consecutive quarter now. What's happening on that front? And how should we expect your investments in that area to pay off?

We -- I think we've got a solid start to the year, and we're really happy to be able to bring in 460 new customers. Why do we are focused on increasing that number is given the size of the TAM, we believe that we can and should be adding -- seeing increase in the number and adding even more new customers. We have been making a number of investments across a multitude of areas in the company to make sure that we focus on and address this area. And I believe that we're on track to hit our target that we articulated a year and change ago by the end of FY '20.

Got it. And Doug, you mentioned about GDPR. Can you talk -- tell us a little bit about how it helps you and when we should start seeing some benefits from that to flow in? That's it for me.

We are seeing more awareness that some of the compliance elements with GDPR come back to similar structures use cases capabilities that we've seen for lots of other monitoring and detection use cases. And obviously, security and IT ops are the 2 primary. But even something like our industrial asset intelligence app, that ultimately is grabbing a whole array of signals from centered equipment and parsing through those to try and flag alert remediations, potential issues, predictive analytics so you can get in front of issues on the shop floor. GDPR and GDPR compliance has allowed same characteristics I've viewed as one of the thousands of use cases that Splunk could be applied to within an organization. We do have a -- we call Splunk Essential. We have a cookbook for how you would implement Splunk and what kind of data sources you would go and grab and what kind of visualizations you should probably start with if you want to use Splunk to help you with GDPR compliance and visibility. And so we're seeing more customers include a, "hey, can you help me with GDPR set of questions," along with can you help me with ITOps? Can you help me with AppDev? Can you help me with security analytics? Or can help me with some of my customer intimacy or manufacturing use cases as we work to make people more aware of the multitude of use cases and benefits that Splunk can drive for customers.

And our next question comes from the line of Matt Hedberg from RBC Capital Markets.

Doug, maybe starting with you. You guys are obviously doing well in ITOM and security, but it also seems like IoT continues to percolate up as a nice sort of vertical driver. I guess, speaking along the lines of a broader vertical app strategy, how do you guys think about the cadence of building out incremental vertical apps that sit on the platform? I guess, I'm wondering, might we see at some point some applications graduate out of Splunkbase that you take in-house?

I mean, we definitely with -- I think we've been working on emphasizing more attractiveness in the ecosystem around Splunkbase. Okay, more people to understand the platform, participate, contribute, et cetera. And yes, we see steady growth in different solutions that exist on Splunkbase, still largely centered in security and IT, ITOps/AppDev. Our launch of industrial asset intelligence, while I'm excited about that solution, I think it adds a lot of value. My main emphasis is -- plus we've been talking about how it can be used in IoT for so long. Let's put a beacon out there that I think is relatively horizontal. There's a lot of industrial situations, I think, that can benefit from IAI. But let's really use it as a more-defined example that hopefully inspires and instigates more people to think through additional use cases and solutions/apps that can be created in that IoT or business analytics space. There's the separate piece of how many of those do we want to own and control. And my view over the next 3 or 4 years is that if we continue to do things properly, we will increasingly become the minority as far as monetizable solutions around the Splunk platform. But for now, we're still relatively early in our journey, and a lot of the work to get these types of solutions done is coming from our team combined with third parties to help them understand how they're attacking these different problems.

Super helpful. Maybe a quick one for Dave. Maybe I missed this, but the last quarter, you talked about fiscal '19 cloud billings. I think you said about $270 million in revenue of about $160 million. Did you guys update those after Q1?

No, we didn't. The full year guide for revenue for cloud for fiscal '19 is $160 million.

That's what it was and that's what it remains unchanged at this point?

Correct.

And then billing was also, I think you said $270 million last quarter?

That is what we provided last quarter, yes.

And our next question comes from the line of Mark Moerdler from Bernstein Research.

I'm not sure if you give this, but what was the mix between potential license and term licensing in the quarter? And then a follow-up.

Hey, it's Dave. Yes, we used to provide mix as an annual guide, and then a quarterly update. And instead of providing our quarterly pressure about that mix. We said, look, we're just going to give you an annual target, which, for this fiscal year, is 65%, up from just over 50% last fiscal year. So you didn't miss it because we're not providing it on a quarterly basis.

Okay. On the term of the cloud contracts, can you give us a sense of what the average contract firm length is? And maybe consider you've been given that more frequent basis so that we can have a sense of how modeling as that term contracts obviously lengthen out and how we could think about the value of the term contracts and the cloud contracts to the licenses?

Sure. So for the first quarter, the overall contract duration between cloud and term was like 27, 28 months. That's been pretty consistent. It's up a little bit in the quarter. But I just remember, seasonality can be impactful in terms of that rate. And what I mean by that is, in our seasonally smallest quarter, a handful of orders can have an impact on duration more so than in our fourth quarter. But when -- the first question I -- around, what's the composition of the balance sheet and the old metric around billings, it is important to note, as we look to increase percentage of our business that is subscription, i.e. term and cloud, that as long as duration is shorter than 36 months, those transactions are smaller, then what would be an equivalent perpetual plus 1-year of maintenance transaction.

Right. Obviously. Then the only part that then goes with it is, at some point, renewal on those terms, but it's probably too early for that.

Yes. Certainly, at these growth rates, that's true.

And our next question comes from the line of Kirk Materne from Evercore.

Just eleventh on Doug, Doug, you touch on this a little bit early, but when we do you think about your partner ecosystem right now, it feels like the security sort of use case with a partner, it gets us very, very strong. When we think about the big global SIs, are they starting to try to think about other sort of use cases? Are you getting industry-led partners to come in and talk about of use cases of Splunk, either operational, analytics, IoT? I'm just trying to get a sense if that partner ecosystem can start to become a little bit broader from a use case perspective?

Yes, that is -- when I think about the market group leaders, security, ITOps and AppDev, business analytics, IoT, there's a handful of things that they are tasked with. One absolutely is deep domain knowledge and understanding of their segment. The other is guidance of any type of solution that we are responsible for, Enterprise Security, UBA, ITSIs as examples. But the third is curation, development and overall corralling of the ecosystem with each one of those different areas. And the IoT arena, in particular, I think is going to continue to stand out as a segment that is much more dependent on partners than security or ITOps, given the much higher variety of vertical specific use cases, and therefore, the need for people with deep domain expertise in the vertical as well as some degree of technology under data expertise. There is -- we're definitely seeing, as we're -- as we -- as -- Ammar Maraqa who heads that vertical, looks at the prioritized verticals, and then starts to talk to different partners in each one of those verticals. We're seeing a little bit more awareness and excitement on -- of who Splunk is and why they might want to pay attention to us. I think the challenge that we see is a lot of the real strong relationships and strong expertise is housed by people that don't have the brand names that we'd all be familiar with. So we keep leaning on the Accenture's and the Deloittes and Capgemini's and others. I mean, those are important partners in this area. But I think they have to be augmented with specialty SIs and ecosystem participants that really will help close the gap the last mile to effective delivery for those use cases.

Got it, that's helpful. And then a quick one for Dave. Dave, I know it's sort of -- it gives you usually pretty good hiring period for you all. Are you guys sort of on track with what you wanted to add from sort of just a gross net adds basis in the first quarter? And I assume, that got off to a pretty good start just based on -- I was expecting it to be a little bit more of our upside were flowing through, but I know you guys are obviously investing pretty heavily this year.

No, hiring is actually really strong for us. It's really encouraging to see candidly as we have to continue to increase our capabilities, both in product and, of course, in the field. So I think from an organic perspective, hiring for the quarter was really strong. Of course, then we added in some headcount from the Phantom team so that the addition there, I think we ended the quarter with over 3,600 total employees globally. So I'm actually really encouraged by the rate of onboarding. It's putting some pressure on the G&A organization to make sure that we effectively onboard all those kinds of folks. But that's a good kind of pressure to have. So we're -- yes, we really have a good start to the year in that regard. So thank you for that question.

And our next question comes from line of Karl Keirstead from Deutsche Bank.

David, I've got 2 for you, one on Phantom and the other one on cash flow. On Phantom, David, what are you assuming as the 2Q revenue and deferred revenue impact of closing the Phantom deal? And then, secondly, on operating cash flow, superstrong at $76 million. That was way above what we were thinking. And that represents about a quarter of your guide for operating cash flow for the full year. When I go back Q1's, normally like 16% to 18% of cash flow drops in Q1, so for it to jump to 25% tells either that something unusual happened, your $300 million guide is just too low, or maybe this subscription mix shift is changing cash flow seasonality. But if you could pinpoint it, that'd be great.

I agree, Karl. If I could pinpoint it, it would be great. No, levity aside. Yes, the cash flow yield as a percentage of revenue was obviously very strong. But it's really indicative of what was a tremendous performance by the company in the fourth quarter. So the collection capabilities that we realized were off of that strength. If I then fast forward for the balance of the year, I will affirmatively reiterate our expectation for the year is for $300 million of operating cash flow. We'll have to monitor that as we progress through the year. And of course, our bigger quarter is ahead of us. And the billing characteristics, the invoicing, I should say, characteristics of our customers is something that we're going to continue to measure and of course, update our own expectations as well as those that we set with you guys. As it relates to the impact of Phantom on our financial statements, I would say the impact on deferred revenue and then any revenue that we'll be realizing is really de minimis, not even impactful in terms of how we've modified our adjustments or our internal outlook. The biggest impact, of course, is from an operating expense perspective as we parachute in almost 100 new employees at once.

And our next question comes from the line of Steve Koenig from Wedbush Securities.

Maybe one for Dave and one for Doug. Let's see. So Dave, I like your answer on the last question. It made me laugh. (inaudible) the -- maybe just big picture on the -- if we think about the factors that can affect the 606 revenue, and they get really lumpy, you reported it up 37% year-on-year. Things like cloud mix and duration, which you've already addressed duration a little bit. But cloud mix and the shift to term, are you able to tell us, did that affect the revenue comp in Q1 significantly, either positively or negatively?

Well, as much I as I don't want to go back in the time machine, I think we were pretty transparent that we had some inconsistent performance in Q1 of last year, and that was reflected in our financial statements on a 605 basis. If you -- and then once we go back and we recast prior-year revenues, again, the seasonality effect is really evident because the change in revenue under the adoption of the new standard had a fairly impactful reduction in Q1 of last year. So from a comparability perspective, we had some spots we didn't like in last year's quarter but comparability wise, pros or cons, those are all played out. And that's why it was important for us to do full retrospective so that we can give you comparable results and try to cut through the differences in our delivery vehicles, i.e. perpetual term or cloud. So again, the growth rate of 37% reflects a comparable 606 basis where term cloud and perpetual are all being treated the same way.

So Doug, the one for you. I think you've -- on the call, you've addressed most of the comments you made at the Analyst Day about the transformation initiatives inside the company that are going on. Maybe the one thing I didn't hear as much about on this call is what you're looking to do around cloud? You mentioned things concerning ease of use, rapid updates of technology, et cetera. Are those, those currently reflected in the quarter? Are those futures? Kind of maybe give us an update on your progress there with what you want to do with cloud?

It's a -- yes, it's an end. I mean, there's a lot of, I think, enhancements and leaning that we've done and that we're always doing to try and decrease costs associated with Splunk, the usage of infrastructure, et cetera, increase the approachability. Yes, we've been injecting natural English processing into Splunk. There's a whole bunch of visualizations and views. We've got a product coming out in the future that will be much more targeted to casual business users and people that don't have any interest in ever learning any type of language. So it's a -- we're attacking it constantly and from every angle. What I see with cloud and why we've been talking to hybrid for so long is the world right now still, I think, is very binary and bipolar on cloud and on-prem. And we believe and see a very hybrid world. And my belief and prediction is baked in no our product road map is that 3 to 5 years now, people stop talking so much about cloud. They're a little bit on-prem, there be bits on the cloud, there's bits on-prem and the cloud will be uniformly managed in more or less invisible and where they live and they lived with they need to live because of the use case. Yes, because of the loss of physics and any type of data governance or control that you want to have, et cetera. So what you'd see -- where you'll see, as we continue to drive releases, is a continued blurring of the lines. I think Adobe has done a really good job of this as a living example of that on-prem and cloud world.

And our next question comes from the line of Jesse Hulsing from Goldman Sachs.

Maybe the first one for Doug, and then I have a quick follow-up for Dave. When you look at early users of the industrial app, how are data volumes trending versus what you see in security and operation? And just wondering, is there potential for data volumes? And I guess, it would follow that deal sizes would follow that to be bigger? Or is it too early to tell?

Well, there has been so much dialogue of the year on our data volume-driven pricing. And what -- what I talked the early and what you'll continue to see is different iterations and packaging of both underlying Splunk platform as well as different solutions that provide more options for customers that are not always data-driven. Right now, in the beta and limited availability release, customers are -- the way they were -- we'll likely -- you'll likely see this product to be framed is not a data volume basis. I think the volumes can be much larger and they can be smaller, depending on what we are automating and what the characteristics for the data sources look like. But the value and the interfaces and the tech that's necessary, I think are all iterations of what we're doing today, but our iterations are different then given the very different user profiles, capabilities, skills and data life scenarios of process engineers and more casual line of business users versus the much more technical security analysts and IT, ops and [less] that we traditionally have been addressing. So there's our road -- a continued roadmap of capability, technology and release, and you'll see more and more options on pricing that will start to take the lens off of just data volume.

Yes, that makes sense. And then, Dave, it seems like people have been trying to triangulate on this billings versus revenue thing for most of the call. I calculated 606 billings growth of 18%-ish and 606 revenue growth is in the high 30s. Is bookings growth closer to revenue growth or closer to billings growth? If you can answer that, I think that will be helpful for everyone.

Yes, that's a fair question. We're not -- I'm not really sure how to answer in the right way. I think what's important is, over the balance of this year, as we all move towards what will become the standard pallet of disclosures under 606, we will retire. I think everyone will retire billings. That's why you felt it was important to give a baseline for the RPO disclosure of $765 million so that we can start to measure what is, I think, probably a more insightful disclosure around the gross top line performance of the business that will replace billings as a metric. Obviously, our cloud revenue growth is pretty solid at 89%. Overall revenue growth at 37% for the quarter. And importantly, software revenue growth, which is the license, basically on-prem plus cloud at over 40%. So if you're thinking about well how effectively are you guys growing, those are really the metrics to stare at today.

And then a quick follow-up to that. Any chance that you provide RPO, change in RPO, I guess, from a year ago so that we have comparable growth rates?

Yes, I -- today, our decision was to provide the sequential change. I do think that the metric will develop over the course of the year, and we'll update our thinking around that to make sure that we're giving you guys the best view in terms of how to measure our progress. Today -- and of course, how we measure our own progress. We really want to share the way we measure ourselves with everybody externally. And today, we believe revenue is the key metric to follow and in particular, software revenue.

And our last question comes from the line of Mark Murphy from JPMorgan.

This is Matt Coss, on for Mark Murphy. CapEx for the quarter was $2.3 million, which seems to be a little over relative to last year's run rate. Will CapEx spending catch up to be closer to last year spending? And do you expect any catch-up to happen starting next quarter?

Yes, the start of the year, we set our expectation for about $25 million in CapEx for the year. Now it's not perfectly linear. Obviously, it's tied to 2 things. One, the rate of on boarding employees. And two, what happens to be happening globally from a facilities perspective. Those are the 2 large consumers of CapEx. So I wouldn't model anything other than planned for $25 million for the year. And don't change that estimate based on Q1 results.

Okay. And then your ratable bookings as a percent of total. I think your latest guidance, well, you say a couple of times 65% this year. 75% next year, I think, was the fiscal '20 guide. Is there a longer-term target you have for this? Or a theoretical upper limit? And then maybe a timeline on -- rev timeline on when you get there?

Yes. At this point, there isn't anything theoretical or aspirational beyond what we've provided for fiscal '20, which is 75%. 65% this year, and we're pleased with the progress that we made in the first quarter. And we're off to a good start in that regard.

And at this time, I'd like to turn the call back over to Ken Tinsley for any closing remarks.

Great. Thank you, Bruce, Appreciate your help today. And thanks, everybody, for joining us. We're available if you have any questions tonight. Have a good evening.

Ladies and gentlemen, thank you for your participation in the today's conference. This does conclude the program, and you may all disconnect. Everyone, have a great day.