Tag Archives: 1.0 Overview and Index

A Different Take On Splunk

Not too long ago, Splunk (SPLK) announced its Q4 FY ’18 and full-year FY ’18 results, and those results were generally received gleefully by analysts and investors alike. Jim Cramer, for example, hosted Splunk’s CEO, Doug Merritt, on “Mad Money” and suggested that Splunk is still in the “early innings” in terms of growth.

On March 27, 2018, the company held an Analyst Day to discuss its performance, forecast, and strategy moving forward. Broadly, the company laid out a revenue goal of $2 BB by FY ’20, with non-GAAP operating margin growth along the way. Its underlying strategy – again, broadly speaking – revolves around a transition to subscription-based licensing, additional market penetration, sales coverage, and growing the company’s cloud business.

In this article, I attack elements of Splunk’s outlook and strategy based on irregularities/risks that I believe are exposed through an analysis of the earnings call discussion, the Analyst Day presentation/discussion, and the company’s financial data.

The last article I published on Seeking Alpha – nearly eight months ago – discussed my reasoning against a Cisco (CSCO) acquisition of Splunk. For reasons beyond the scope of this article, I actually hesitated to publish it. Ultimately, I did publish, and it elicited, shall we say, a strong reaction. With most sentiment around Splunk fervently bullish, I expect this article and its decidedly bearish tone might evoke a similar reaction.

So be it. I reiterate from the prior article that I don’t believe Splunk is in its early innings of growth anymore, contrary to the position held by Mr. Cramer. That view, coupled with the risks I discuss herein, led me to recommend that existing investors think carefully about their position.

As this article became a bit longer than I originally expected, I divided it into numbered sections. While the sections do relate to each other, some readers might consider “moving between” sections, as opposed to reading the article sequentially.

The article index is as follows:

1.0 Overview and Index (i.e. what you’re reading right now).

2.0 A Quick Look At The Numbers

3.0 Operating Margin Is… Uh… What Now?

4.0 Analysts/Investors Are Ignoring Risks Around Licensing Mix

4.1 Subscription Renewals Are Not A Layup

4.2 License Model Impact On Operations

4.3 License Model Impact On Average Deal Size

4.4 Summing Up The Risks Around Licensing Mix

5.0 Market Strategy May Be Unrealistic

6.0 Don’t Count On Cloud

7.0 A Quick Look At Insider Trading Behavior

8.0 Conclusion

Finally, Splunk Annual Reports, which I reference, can be accessed here. I’m also including, along with the article, Splunk’s earnings call transcript and Analyst Day presentation, along with supporting financial data:

Q4 FY 2018 Earnings Transcript

Analyst Day FY 2019

Q4 FY 2018 Earnings Press Release

Insider Trading

2.0 A Quick Look At The Numbers

Before we dive in, let’s take a quick look at Splunk’s Q4 ’18/FY ’18 performance as presented during its earnings call. Splunk’s fourth quarter revenue was $419.7 million, up 37% year over year, fiscal year revenue was $1,271 billion, up 34% year-over-year, and billings also increased healthily in both periods. But GAAP operating loss for the quarter was $23.9 million, and GAAP operating loss for the full year is $259 million.

Splunk FY ’18 Fourth Quarter Highlights

Total revenues were $419.7 million, up 37% year over year. Total billings were $622.8 million, up 44% year over year. GAAP operating loss was $23.9 million. GAAP operating margin was negative 5.7%. Non-GAAP operating income was $73.0 million. Non-GAAP operating margin was 17.4%. GAAP loss per share was $0.18. Non-GAAP income per share was $0.37. Operating cash flow was $146.1 million with free cash flow of $139.5 million.

Splunk FY ’18 Full Year Highlights

Total revenues were $1.271 billion, up 34% year over year. Total billings were $1.551 billion, up 38% year over year. GAAP operating margin was negative 20.0%. Non-GAAP operating margin was 9.2%. Operating cash flow was $262.9 with free cash flow of $242.4 million.

Splunk noted during its earnings call that “for the full year, operating margin was 9.2% above our expectations due to the strength of our overall top line performance.” The company went on to say,

“given our op margin outperformance in fiscal ’18 and considering the benefit we expect to receive from the commission changes, we are increasing our op margin expectation for fiscal ’19 to 11.5%, up from the 10.5% we previously guided.”

I had originally planned to discuss operating margin toward the end of this article, but let us begin our analysis there.

3.0 Operating Margin Is Uh What Now?

Splunk’s non-GAAP (keyword is “non-GAAP”) operating margin was an important topic of discussion during the Analyst Day. Before diving into the margin discussion, I’d like to reiterate another point I made in my last Seeking Alpha article discussing Splunk.

“Splunk’s expense ratios are especially high largely due to stock-based employee compensation, which the company omits for its non-GAAP results. But, investors should carefully consider these non-cash costs. As Warren Buffett said in his FY 2015 Annual Report:

“…It has become common for managers to tell their owners to ignore certain expense items that are all too real. ‘Stock-based compensation’ is the most egregious example. The very name says it all: ‘compensation.’ If compensation isn’t an expense, what is it? And, if real and recurring expenses don’t belong in the calculation of earnings, where in the world do they belong?”

I encourage readers to keep the point above in mind.

Moving forward, the company, like most other software vendors selling subscription licenses, will report results under the new ASC 606 accounting standard vs. the “old” ASC 605 standard. Under this rule, software companies are able to recognize the full value of certain subscription licenses upfront. This is delineated in the slide below, presented during the Analyst Day:

Source: Splunk Analyst Day Presentation

This accounting change impacts Splunk’s reported income. For example, as per the slide below, under 606, total revenues for FY ’17 decline from $950 to $944 MM, while revenues for FY ’18 increase from $1,271 MM to $1,309 MM. We also see that non-GAAP operating margin for FY ’18 increases from 9% to 14% under 606.

Source: Splunk Analyst Day Presentation

The purpose of this article is not to go into the intricacies of the new standard, although I urge readers to review the following for a good overview: ASC 606 & IFRS 15: How the new Revenue Standards will impact Subscription Companies – Zuora).

However, I do wish to highlight some irregularity in terms of how Splunk presented its operating margin results during the Analyst Day. The company presented this slide to highlight non-GAAP operating margin growth:

Source: Splunk Analyst Day Presentation

Now, consider the data above in context with this slide:

Source: Splunk Analyst Day Presentation

In the slide above, on the left, Splunk illustrates the operating margin improvement for FY ’18 under 606 from 9.2% to 14.2%. On the right, the company illustrates how it arrives at its forecasted operating margin of 11.5% for FY ’19, again under 606.

But now, look back at the operating margin leverage slide where the company appears to show non-GAAP operating margin growth. The company has mixed results from 605 and 606 accounting standards to create this growth curve. Specifically, in this slide, the 9.2% non-GAAP operating margin result for FY ’18 is under 605, whereas the non-GAAP operating margin forecasts for FY ’19 and FY ’20 are under 606. This slide is misleading in my view. It’s a bit like mixing GAAP and non-GAAP results together.

In fact, if we normalize the last three data points in this slide under 606, we have the following (asterisk delineates forecast):

FY ‘ 18 FY ’19* FY ’20*
14.2% 11.5% 14.0%

So, non-GAAP operating margin is really not forecast to increase, it is decreasing between FY’ 18 and FY ’19 and actually roughly flat between FY ’18 and FY ’20. During the Analyst Day Q&A period, one of the analysts (Walter) pointed out that the company is staring at “flat margins with the same profile of revenue,” meaning the top-line goal of $2 BB by FY’ 20 has remained steady over various Splunk forecasts. This analyst suggested that perhaps the “missing link,” in terms of why operating margin is flat, is the company’s activity around reinvestment initiatives. Dave Conte, Splunk Senior VP and CFO, replied as follows, which I transcribed from the Analyst Day webcast:

“So, at this time last year, the $2BB milestone was always under 606, so that transition to subscription, which we laid out the path on that subscription journey, was also fundamental to that outlook. And at that time, the guide that I provided was 12 to 14 percent. OK, so now that we’ve progressed, we’ve got a year under our belt, we’ve got 24 months to go, well 22 and a half months to go to that endpoint milestone, I’ve increased the guide to 14. And I think the important part on this, this 606 adoption is there’s a benefit from commission accounting, because we always had built in the transition, the 606 revenue transition, that was always fundamental. The benefit for us is in the commission accounting, OK. That’s the piece that we’re reinvesting. And the numbers I showed, again, I think I said explicitly this isn’t guidance, but it’s as an example, OK the guide is 11 and a half percent positive operating margin. We get some benefit from changing commission accounting which we are reinvesting in the initiatives represented by my colleagues on the stage today.”

(If you’d like to listen to this particular question/answer, it is around the 3:41 mark – that is, 3 hours, 41 minutes.)

Dave Conte’s answer to the question seemed rather indirect to me. A simple answer would have been along the lines of “Yes; operating margin is expected to be roughly flat between FY ’18 and FY ’20 due to reinvestment activity.” Moreover, Dave Conte’s answer does not explain why 605 and 606 accounting standards were mixed on the operating margin leverage slide, although, admittedly, he was not asked that specific question. Finally, it would have been helpful if his answer explained why the company has raised non-GAAP operating margin guidance for FY ’20 from 12% to 14% (the 12% figure was presented in FY ’17).

I’m concerned as to why the company appears to obfuscate margin performance on the operating margin leverage slide, in an effort to create the appearance of growth.

Also, Splunk has provided through its own commentary some reasons to think that operating margins are at risk. As we will discuss further in the article, Dave Conte has stated that he expects subscription license durations to ease down. If that is so, an investor should wonder if that fact is in conflict with the increased guide for FY ’20. After all, the company has indicated they intend to reinvest the main expense benefit that they receive under 606 (i.e. commission expense). So, if you are reinvesting your main accounting benefit, and subscription contracts – which will dominate your license mix (we’ll discuss this in detail in a moment) – are expected to be shorter in duration and therefore lower in value, where is the increased operating margin guide coming from for FY’ 20?

I also would remind investors of Splunk’s GAAP operating margin performance from FY’ 2012 through FY’ 2018:

Data Source: Splunk Annual Reports FY ’13 – FY ’18, Chart Source: Yves Sukhu

GAAP margin has been trending in the right direction over the last few years, but given the discussion on non-GAAP operating margin above, I’m concerned about a possible reversal.

I reminded readers at the outset of this section that Splunk backs out its rather large stock-based compensation expense to generate non-GAAP results. In fairness, the company indicated during the Analyst Day that this expense is normalizing:

Source: Splunk Analyst Day Presentation

While this may be so, it is the approach of backing out the expense, and not necessarily the expense itself that is concerning. Given the approach to calculating non-GAAP results and given how the non-GAAP operating margin figures were presented/discussed during the Analyst Day, I personally am led to believe that there may be substantial risk around future operating margin performance (both GAAP and non-GAAP).

4.0 Analysts/Investors Are Ignoring Risks Around Licensing Mix

During the earnings call, Splunk noted that its “largest tailwind is term license bookings.” By “term license”, the company is referring to on-premise software licenses with a fixed duration (e.g. one year, two years, etc.), which of course is in contrast to a perpetual license that a customer owns forever. To be clear, Splunk also sells cloud-based licenses which also have a fixed duration but are (obviously) used in the cloud, and not on premise.

NOTE: Splunk often uses the word “duration” to reference its non-perpetual license types (term + cloud). I will use “subscription” in this section and throughout the article as an equivalent term.

Splunk is moving from a dominant perpetual license model to a dominant subscription license model, with term and cloud licenses expected to comprise 75% of bookings by FY 2020.

Source: Splunk Analyst Day Presentation

This is not surprising, as the enterprise software industry in general is moving in the direction of subscription-licenses over perpetual licenses. However, let me inject a bit of personal anecdote here which is relevant to the discussion: No software company “wants” to move to subscription-based licensing over perpetual licenses if the latter was how they were previously selling. They are doing it because they don’t have a choice.

Analysts on the earnings call, as well as those participating during the Analyst Day, seemed to be generally pleased with Splunk’s growing percentage of subscription-based licenses since none brought up any major objections/concerns. It’s reasonable to assume that analysts believe Splunk will grow its subscription-license revenues at an increasing rate that exceeds the declining rate of perpetual licenses. On the surface, revenue and sales data seem to support that belief. First, Splunk’s top line has continued to grow at an impressive rate, and software license growth specifically has grown at a 44% CAGR since FY 2012.

Source: Splunk Analyst Day Presentation

Source: Splunk Analyst Day Presentation

Second, Splunk’s average sales price has increased steadily.

Source: Splunk Analyst Day Presentation

These trends have occurred as the license mix has been shifting. However, a deeper analysis exposes potential issues that analysts/investors may be overlooking and avoiding.

4.1 Subscription Renewals Are Not a Layup

Stating the obvious, customers like subscription-based licenses since they allow costs to be spread out over time (i.e. versus a single up-front payment for a perpetual license).

Customers also like subscription-licenses from the standpoint of limiting their “lock-in” with any given vendor. Arguably, customers are less likely to leave a technology for which they have a perpetual license, given the nature of the license itself, as well as the (likely) large, upfront cost that they paid to acquire the license. Since subscription licenses are temporary by definition, customers may be more inclined, at the end of their license terms, to consider their options.

As I see it, herein lies the challenge for Splunk (and many other software companies) given the shift to more subscription-based licenses.

The company’s re-subscription rate “may” fall over time as competitors and new market entrants give customers pause before committing to another subscription period. In its FY 2017 Annual Report on page 19, Splunk states:

“Any decline in our customer renewals could adversely affect our future operating results(Much) of our software is sold under perpetual license agreementsIn order for us to improve our operating results, it is important that our existing customers renew their term licenses, subscriptions and maintenance and support agreements when the contract term expires Our customers have no obligation to renew their term licenses, subscriptions or maintenance and support agreements with us after the terms have expired.”

As mentioned above, customer preferences have shifted toward subscription-based licensing precisely because they do not want to be locked into technologies over multiple years. Perhaps executive management indirectly makes this point on the FY ’18 Q4 earnings call where David Conte stated:

“We expect duration to ease down as the (subscription license) pool gets larger.”

He goes on to say:

“The typical behavior for customers under a subscription contract is to pay annually.”

As best I can tell, Splunk does not provide data on their retention rates for subscription licenses. But, the “law of competition” dictates that retention rates “should” decline over time. Of course, by how much and how fast is difficult to answer. From a top-line perspective, Splunk’s growth in subscription revenue must obviously be greater than any declines due to subscriber loss.

Moreover, Splunk may come under pressure to renew customer subscriptions at an increasing frequency if subscription periods continue to “ease down.” You might argue that the subscription period will eventually reach a “bottom” because Splunk simply will not write subscription contracts for less than a given duration (e.g. one year). I agree with that argument. However, let us again think about the possible effect of competitive pressures. If competitors opt to move into shorter-duration subscription contracts (e.g. month-to-month), Splunk may have no choice but to follow suit.

Granted, what I have written above is speculative. But I’d argue that it is “reasonably probable.” I believe analysts and investors are assuming (incorrectly) that subscription-based revenue will continue to grow without any significant subscriber loss. This is a risky assumption, to say the least, in the face of a highly volatile and competitive market.

To close this section, I note that not one analyst on the earnings call, or during the Analyst Day Q&A period, asked about subscription retention rates (historical or forecasted).

4.2 License Model Impact on Operations

Let’s also think about the move to a subscription-dominant licensing model from a structural perspective. Splunk presently has a “heavy” direct sales force, with sales/marketing costs accounting for nearly 64% of total revenues in FY ’18. It may prove difficult to support that kind of sales model on a preponderance of short-duration contracts because of the potential variability in revenue. If the revenue mix is going to favor shorter-duration subscription-based contracts moving forward, then Splunk will likely incur pressure on its current sales model. It would seem Doug Merritt, Splunk CEO and President, hinted at this point on the earnings call, again – without stating it directly, saying:

“we could have a growing and more effective and monetizable ecosystem of partnersand continued sales migrationfrom a heavy direct to a much more blended group.”

(Readers are encouraged to review the full transcript for context.)



Data Source: Splunk Annual Reports FY ’13 – FY ’18, Table Source: Yves Sukhu

As we see above, sales and marketing has been Splunk’s largest operating expense. Does Splunk need a direct sales model to survive? Presumably yes, unless they’ve enjoyed setting a match to piles of money over the last several years. Moreover, as will be discussed later in the article, Splunk intends to sharpen its focus on markets outside its core IT Operations (ITOM) and Security markets via sales coverage.

It seems reasonable, therefore, to assume that sales and marketing expenses will continue to be the largest operating expense moving forward. It should be pointed out that historically Splunk’s ability to support such an expensive sales force has rested on a licensing mix that was dominated by perpetual licenses. So, the company’s ability to maintain its current sales structure on a preponderance of subscription licenses is unclear and “untested.” That’s not to say that it cannot be done. But, it is a significant risk.

4.3 License Model Impact on Average Deal Size

Let’s revisit the slide that Splunk presented on Average Selling Price:

Source: Splunk Analyst Day Presentation

It’s an impressive chart, especially as average selling price has more than doubled since FY ’12. As the company implies in this slide (and states explicitly elsewhere), increased customer adoption over time is driving the growth in ASP. Perhaps even more impressive is the chart displaying the number of deals over $1 million:

Source: Splunk Analyst Day Presentation

Naturally, an abundance of large deal sizes helps to increase the overall ASP. Evidently, Splunk believes the trend in ASP growth will continue in spite of the change in licensing mix. ASP is extremely important, as it is a key input into maintaining/growing operating margin. Will Splunk’s trend in ASP continue?

I see four potential problems.

1. The first problem lies with the ability for the company to continue driving enterprise adoption agreements (EAAs). The company defines EAAs as follows in its FY ’17 Annual Report:

“From time to time, we also enter into transactions that are designed to enable broad adoption of our software within an enterprise, referred to as enterprise adoption agreements. These agreements often include provisions that require revenue deferral and recognition over time.”

Per the last slide, Splunk has done a good job demonstrating growth in these types of contracts. And the company might well continue this trend. However, there are a couple potential issues with EAAs:

EAA contract volume can “swing” from one extreme to another year over year. Often, companies can have blowout years with large numbers of enterprise agreements, and less-than-stellar years in between the blowout periods. This typically has to do with the multi-year nature of EAAs, as well as the fact that this type of agreement is usually suitable for only a subset of a company’s customers. With regard to the multi-year aspect of EAAs, a customer who enters into a three-year EAA is, more than likely, not going to do another deal until that three-year period is expired. With regard to the “limited” suitability of this kind of agreement, it is possible for a company to “exhaust” its EAA customer pool by simply selling such agreements to all available (typically large) customers. Recurrence is not guaranteed. Let’s say that a customer’s EAA lasts for three years. By the time the EAA is ready for renewal, the customer may have other, perhaps less costly, options to consider vs. renewing the EAA or entering into another kind of license agreement. Of course, the idea of the EAA is to get the customer to deploy as much of the Splunk software as possible during the EAA period. Even so, it is still possible for a customer to identify a competing technology during the EAA term and determine that it may be better for them to switch to that technology (for whatever reason).

A decline in EAA revenue volume will drag on ASP. In fact, Dave Conte acknowledged that “bubbles” are possible with EAAs in his presentation during the Analyst Day. But he also indicated that he personally believed Splunk’s EAA growth will continue.

2. The second problem lies in the average value of subscription licenses. Average subscription license value will be less than the average perpetual license value, and Splunk noted during the Analyst Day that their financial models are built on the assumption that subscription licenses will be roughly two-thirds the size of a perpetual license. (I do leave open the possibility that there could be some unusually large subscription license sales.) If perpetual licenses become the smallest piece of the “license pie,” then, under one scenario, the average perpetual license deal size will have to increase to compensate to maintain ASP. Simply, the dynamics of the new licensing mix may make it more challenging for Splunk to maintain, much less grow its ASP.

3. Competitive pressures are likely to drive down the average value of all license types (subscription and perpetual). Consider the following statement from Splunk’s FY ’17 Annual Report:

“During fiscal 2015, we increased the license capacity of our entry-level licenses for Splunk Enterprise and decreased the price of Splunk Cloud. Although we believe that this price reduction will enable our customers to more rapidly increase their ability to adopt our offerings, there is no guarantee this will occur. It is possible that such price reduction will not be offset by an increase in order volume, which would have the effect of lowering our revenues and negatively impacting our financial results.”

These pricing and licensing moves suggest a reaction to competitive pressures, unless, of course, Splunk was feeling particularly generous in 2015. These pressures will only get worse.

4. Splunk had an unusually large number of “mega-orders,” larger than $10MM in FY ’18:

Source: Splunk Analyst Day Presentation

These “mega-orders” were not backed out when calculating ASP. Arguably, the ASP for FY ’18 is artificially high due to the influence of these very large orders, which obviously show great variation in terms of their number year over year in the slide above. As with EAAs, there’s a certain subset of Splunk’s overall customer base that can “absorb” such a large transaction. I have no idea how large that subset is, so perhaps Splunk has many more opportunities to sell such large deals. An analyst (Jesse) inquired about the unusual number of large orders in FY ’18 and asked why it happened and if investors should expect that kind of large order performance moving forward. Dave Conte replied that he could not say it was a “new normal” and offered no explanation as far as why so many large orders were processed in FY ’18. Accordingly, investors should be prepared for volatility in terms of the number of these transactions executed year over year.

4.4 Summing Up the Risks Around Licensing Mix

If we aggregate the main points of sections 4.1, 4.2, and 4.3, Splunk’s top-line, operating margin, and actual operating structure (among other things) are at risk as the company shifts toward a subscription-dominant license model. Certainly, and contrary to everything I have presented in this section, the company could:

Drive high average subscription license values which more than compensate for any loss in perpetual revenue. Drive high volumes of subscription licenses which more than compensate for any loss in perpetual revenue. Outperform in terms of perpetual license revenue despite the shift to subscription-based licenses. Continue the growth trend in large and EAA deals.

My main issue is that the licensing model risks carry a weight that’s not reflected in analyst questions/discussions with Splunk. Yes, some analysts participating in the Analyst Day hinted at some licensing mix concerns, as discussed above. But none truly challenged the company, which I think was a disservice to investors.

5.0 Market Strategy May Be Unrealistic

Splunk repeatedly called attention to its total addressable market opportunity during the Analyst Day. Here is the slide presented:

Source: Splunk Analyst Day Presentation

Almost every data-centric company has a slide like this. The narrative is always the same:

The rate of data growth is so high that our addressable market opportunity is expanding like crazy!

This kind of thinking is misleading, and investors should be wise to it. As any market expands, competition will intensify – barring a monopolistic opportunity, which Splunk does not have in any market. So, while the overall market size grows, the “slice of the pie” that any particular market participant can attack may actually be getting smaller. So, the slide above is really meaningless from an investor’s standpoint without the context of a detailed competitive analysis. It is notable – not in a good way – that Splunk did not offer any substantial discussion on competition during the Analyst Day, nor did any of the analysts challenge the company in regard to competitive pressures.

Splunk calculates its current TAM by summing the estimated market size of the five main solution areas that the company is targeting. Splunk also mentioned the size of these markets in the prior fiscal year (FY ’17) to emphasize not just the sheer size of their TAM but the strong growth rate as well. The data presented from the Analyst Day is as follows:

FY ’18 FY ’17
IT Operations (ITOM) $23 BB $20 BB
Security $11 BB $10 BB
Application Development $13 BB $12 BB
Business Analytics $ 6 BB $6 BB
IoT & Industrial Data $9 BB $7 BB
TOTAL $62 BB $55 BB

Within its two largest markets, IT Operations (ITOM) and Security, the company noted during the Analyst Day that it has only achieved 2% and 6% penetration, respectively. (Assuming they mean that in terms of sales volume, then Splunk generated roughly $460 MM for IT Operations use cases and roughly $660 MM for Security.)

All of this, according to Splunk, means the company has a massive opportunity in front of it.

But I’m confused by Splunk’s strategy which is to “play” in all five markets of the table. I come back to my comment about intensifying competition. Let’s look at Splunk’s two largest markets of IT Operations (ITOM) and Security where – in their words – they have only just started to penetrate and capture market share. Splunk is hardly alone in either of these markets. While they are deservedly a leader in both areas, consider some of the other “heavyweight” players in both markets:

IT Operations Security
IBM (IBM) IBM (IBM)
BMC Software Microfocus
CA Technologies (CA) Intel (INTC)
Dell Software LogRhythm
Microsoft (MSFT) Cisco (CSCO)

As an investor, would you not expect that all of the companies above are going to continue to aggressively compete in these markets as they grow? Why would any of these companies willingly cede any ground/market share to Splunk? And these companies are just the heavyweights. There are any number of startups/niche players that want a bigger piece of the pie. For example, for the Security space (specifically, the SIEM space where Splunk is a leader), here’s Gartner’s magic quadrant:

There are quite a few niche players who presumably want to move “up and to the right.” If Splunk has only penetrated the ITOM market at 2%, the Security market at 6%, has significant market size in both markets but also has significant competition in both markets, wouldn’t it make sense to double down and focus on these markets? Moreover, both the ITOM and Security markets are changing from a technology perspective. As a (possibly oversimplified) example, security has moved from once-upon-a-time simple event capture/monitoring to complex activity analytics where software is tasked with interpreting the “meaning” of various system/network activity and data to detect threats. The latter is not easy to do and is why Splunk has made certain investments in the Security space over the last few years, including the recently announced acquisition of Phantom (an InQTel backed company).

I don’t understand why Splunk would try to attack five markets, when:

The company has good momentum and is a leader in two of those markets. The company claims that there is a lot of open ground in both those markets left to capture. The company has finite resources, is undoubtedly going to face intensifying competition in its core markets, and will likely need to allocate a majority of its resources to keep pace with competitors in those markets.

One analyst (Michael) offered one question along this line of thinking during the Q&A section of the Analyst Data, asking “why now” in terms of emphasizing a focus on business analytics and IoT markets. Doug Merritt broadly responded that the company “really hadn’t put anyone on business analytics and IoT” and that Splunk needs to “put (its) money where (its) mouth is, and find repetitive patterns in those expansion areas.”

In terms of business analytics, Splunk has had this market on its radar since its first year as a public company. The following is from the company’s FY ’13 Annual Report:

Most of our customers currently use our software to support application management, IT operations, security and compliance functions. Our ability to grow our business depends in part on our ability to persuade current and future customers to expand their use of our software to additional use cases, such as facilities management, supply chain management, business analytics and customer usage analytics.

So, here we are several years later, and the company is suggesting that business analytics hasn’t been a focus, nor have they established a repeatable sales pattern for this market. If that’s true, what makes Splunk think they can even be competitive in the business analytics market now? Business analytics is hardly a nascent market, and has become terribly saturated. Some of the major players include:

Business Analytics Heavyweights
Tableau
Domo
Qlik
IBM (Cognos/SPSS)
Oracle (OBIEE)
Microsoft (Excel/Power BI)
SAS

The list above doesn’t even consider players like Salesforce.com (NYSE:CRM), which introduced its Wave Analytics offering not too long ago, and Amazon Web Services (NASDAQ:AMZN), which contracted with Zoomdata (another InQTel backed company) to develop its QuickSight offering. Perhaps this saturation is reflected in Splunk’s own data, as the TAM table shows flat growth in the business analytics market.

So, why is Splunk targeting a market where:

They are late to the party. It is essentially dominated by a handful of super-heavyweight players. It does not offer the same growth opportunity as core markets. They have not yet found a repeatable sales pattern after several years.

It doesn’t seem to make a lot of sense.

In regard to the IoT market, it is so nebulous right now that it is hard to know what it is, and what it isn’t. Last year, I had written a Seeking Alpha article about General Electric (NYSE:GE) where I pointed out the huge variations in IoT market size estimates. I should note that GE, in fact, has a partnership with Splunk for its own IoT initiative. There’s little doubt that, as the sheer number of connected machines and devices grows, then the data volume they throw off will grow. But, to reiterate, it is somewhat difficult to quantify the opportunity here. For example, edge computing is another buzzy buzzword these days, where machine/device data is not “sent” to a central store like Splunk for analysis but is rather analyzed/interpreted “near” the machine/device, or on the machine/device itself. So, just because the volume of data is growing does not necessarily mean that all that data is going to be transmitted, stored, and analyzed in aggregate. The broader point in my article on GE – which I think is also relevant here – was that the company (GE in that case) was throwing around (what I perceived as) ridiculous numbers in regard to their IoT market opportunity.

The application development market offers similar characteristics to the business analytics market in that it has achieved a certain level of maturity and features several heavyweight players.

With a combined $34 billion market opportunity in its core markets (using Splunk’s own numbers), I’m at a loss why the company would even consider stretching its resources. Think about this from the standpoint of research and development (R&D):

Data Source: Splunk Annual Reports FY ’13 – FY ’18, Chart Source: Yves Sukhu

The trend in Splunk’s R&D spend relative to revenue is clear. Investors should ask themselves: How can the company effectively spread these limited R&D resources across five distinct markets, each of which demand specific R&D investment and are highly competitive?

As per Doug Merritt, the company intends to put resources on expansion markets. Since the company clearly believes in a direct-sales-oriented approach for attacking markets, will Splunk hire more salespeople to focus on business analytics, application development, and IoT? Where will the money come from for that? How will the company maintain its operating margin guidance if it expands sales?

I’m forced to ask: does Splunk have or foresee problems with its core markets (ITOM, Security), e.g. saturation, intensifying competition, etc.? If so, that would be worrisome to say the least from an investor standpoint.

6.0 Don’t Count on Cloud

Splunk touted its cloud business numerous times during the Analyst Day presentation and during the associated Q&A section. The company is relying on the cloud business to compensate for declining perpetual license revenue, and to also help it capture more customers.

Let’s focus on the revenue aspect of this business first. Splunk estimates its cloud business will be generating $250 MM by FY ’20:

Source: Splunk Analyst Day Presentation

I have some doubts about this. First of all, the company appears to be extrapolating a trend based on two major data points (i.e. FY ’17 and FY ’18 performance). So, their experience/history with significant revenues from their cloud business is limited, which – one would think – makes it difficult to forecast. Further, think about one of the defining characteristics of cloud-based solutions:

They tend to get cheaper over time.

Did Amazon Web Services (AWS) become the 800,000 pound gorilla that it is by charging MORE for the various services it provides? No, of course not. It captured share by dramatically under-cutting traditional IT solution providers. I remember signing up for AWS in the early days, when I’d receive – every couple weeks or so – an email detailing a continued price reduction of some particular AWS resource.

I seriously doubt Splunk will be able to maintain its pricing in the cloud. Investors should expect significant competition, because, after all, it is the “easiest” environment for competitors to enter due to such a low barrier to entry. Today, Splunk enjoys a strong relationship with AWS, but, let me pose another question to readers:

Why shouldn’t AWS kill Splunk?

Think about Splunk in terms of core capabilities: It is essentially a system for data collection, data storage/retrieval, data correlation, and data visualization. AWS has capabilities in all these areas, and more. They have greater development resources than Splunk. So, again, why shouldn’t they kill Splunk altogether?

Doug Merritt didn’t exactly make this point on the Q4 earnings call, but he noted “AWS’ job is to continue to offer more and more services, both infrastructure and platform services, to the community.” He goes on to correctly note “and our job is to keep adding more value on top of those services so that people would still want to do business with Splunk in addition to, or with, AWS. And that’s just – that’s a game that we all know how to play in tech.” Mr. Merritt is 100% right in his comments. But, if I were an investor in Splunk, I would be deeply concerned that the company, which is telling me cloud is core to its future growth strategy, could be killed off by its biggest cloud partner. Splunk’s “competitive moat” around its cloud business does not look deep or wide.

Naturally, if Splunk is forced to drop pricing in the cloud due to competitive pressures, then the company will have to sell more deals to make up the same amount of revenue.

Splunk also is counting on the cloud business to help the company achieve its customer target of 20,000 by FY ’20. As we see below, the rate of growth in Splunk’s customer count has decreased and flatlined somewhat:

Data Source: Splunk Annual Reports FY ’13 – FY ’18, Chart Source: Yves Sukhu

One analyst (Ramo – I’m not sure about the name spelling) commented about this during the Analyst Day Q&A stating that he was “struggling” with the fact that Splunk has been adding (more or less) 2,000 extra customers per year. He specifically asked: “What’s the thing that’s keeping that number where it is? Is it lead generation? What’s the driver to bring that higher?” Splunk provided numerous answers to the question, but the answer relevant to this section came from Sendur Sellakumar who commented that Splunk looks at its partnership with AWS as a mechanism to capture new customers. Additionally, and discussed earlier during the Analyst Day, Mr. Sellakumar, remarked that one of the strategies to drive business growth with AWS is to have “(Splunk) reps talk with their reps.” This strategy is logical, but not necessarily sustainable.

It’s entirely likely that the realized trend in new customer acquisition via AWS decreases over time for the reasons discussed above. I concede that such a dynamic may not happen in FY ’19 or FY ’20, but I think it is still probable. With respect to the approach of driving a strong relationship between the respective AWS and Splunk sales forces, this makes sense But, don’t you think that every other AWS partner wants to do the same thing? As long as AWS remains “king of the cloud,” everybody will “want a piece” of their sales team to drive promotion and sales of their products/solutions. Splunk will be competing with many vendors for the “mindshare” of AWS reps.

Splunk has painted a rosy picture of its cloud business. But I believe it is likely not to perform or grow with the strength or robustness that has been communicated. It may not be sustainable over the long term.

7.0 A Quick Look At Insider Trading Behavior

Given all the risks I have pointed out in this article, I was curious to explore insider trading activity for Splunk. In effect, I wondered if there were any patterns that might imply insiders are concerned about risk. I looked at activity from April 2012 (the month Splunk stock first traded) through today, using data from openinsider.com.

I found that:

No insider made an open market purchase of Splunk stock during the period analyzed. Godfrey Sullivan, Splunk’s Chairman and former CEO, has – via automatic dispositions – reduced his share count from approximately 2.77 million shares in April 2012 to about 253,000 shares as of March 14, 2018. That represents a nearly 91% reduction in ownership. The total value of these dispositions is just over $357 million.

In regard to the first bullet, we all know insiders usually acquire shares via grants/options. So, the fact that no insiders made any open exchange purchases might strike investors as a “nothing to see here nothing-burger.” Still, if these insiders believe so strongly in the company’s opportunity and prospects, one might expect to see at least some open market share purchases. In regard to the second bullet, it is obviously common for insiders to enter into predefined disposition plans. But that’s not to say that an insider has to enter into a disposition plan. Again, assuming there’s strong belief in the company’s long-term opportunity, why enter into an aggressive disposition plan in the first place?

8.0 Conclusion

Splunk’s stock price over the last 12 months has reflected an almost cult-like enthusiasm from investors and analysts:

Source: Inveyo

Frankly, it would not surprise me to see the stock continue to test new highs throughout the remainder of the calendar year. But I believe such price movements would be entirely disconnected from the underlying business and associated risks.

I believe Splunk’s market opportunity and ongoing operating structure may not be as viable as offered by the company and analysts alike. Further, many analysts, particularly those on the FY ’18 earnings call and participating during the Splunk’s Analyst Day, seem to lack a willingness to truly challenge the company on points discussed in this article. Consequently, major risks are not – in my view – being properly discussed and analyzed by the investment community.

Lastly, I’m troubled by the company’s presentation of non-GAAP operating margin results during its Analyst Day which I felt was misleading. It suggests to me that ongoing operating performance may be at risk.

With current market conditions for the tech sector overwhelmingly bullish, a bearish voice is likely to be drowned out rather quickly. So, I expect much of what I have laid out here to be entirely ignored. Nonetheless, for the small minority of Splunk investors looking beyond price momentum, I urge you to be cautious.

Disclosure: I/we have no positions in any stocks mentioned, and no plans to initiate any positions within the next 72 hours.