Splunk Is a Leading Security Vendor in the Security Operations Space

Analyst

Malik Ahmed Khan

Revenue segments as reported by the company.

License

Cloud Services

Maintenance & Services

Revenue Segments

Gross Profit, Operating Income, and Net Income as a percentage of Revenue

Gross Margin

Operating Margin

Profit Margin

Margins

An operating expense is an expense a business incurs through its normal business operations. Often abbreviated as OPEX.

Operating Expenses

Year over year growth in Revenue and Operating Expenses.

Revenue Y/Y

OpEx Y/Y

Growth

Shares outstanding refer to a company's stock currently held by all its shareholders, including share blocks held by institutional investors and restricted shares owned by the company's officers and insiders.

Outstanding Shares

Market Cap

Also known as Price/Sales Ratio. Calculated using Average market cap for the quarter / Annualized quarterly revenue.

Revenue Multiple

Splunk is a leader in ingesting, indexing, and analyzing machine-generated data, and we believe the company will maintain its leadership status in the near future. We expect machine data to become more pervasive, affecting every part of an enterprise’s operations. With more data to ingest, index, and analyze, we believe narrow-moat Splunk has a long runway for growth as it seeks to continue to dominate the enterprise market.

Splunk’s offerings primarily target two broad use cases: security and full-stack monitoring and analysis, or FSMA. On the security front, Splunk’s SIEM, or security information and event management, operates as a well-refined alert system, putting out alerts if any nefarious activity appears on a client’s IT ecosystem. Splunk’s security orchestration, automation, and response, or SOAR, software is geared toward triaging these issues automatically. SIEM and SOAR software, working in tandem, allows an enterprise’s IT team a reprieve by using artificial intelligence to triage security issues, thereby leading to a substantially lower number of alerts that need to be manually dealt with.

The FSMA space is nascent, springing into existence as a method of unifying and coalescing disparate parts of an enterprise's monitoring framework. Splunk’s FSMA offering seeks to give enterprises a one-stop shop to monitor their entire IT stack, ranging from application performance to logs to end-user experience. Splunk’s offering allows enterprise customers to remove these data silos and monitor the entire IT stack from one consolidated platform. 

We believe Splunk warrants a narrow economic moat thanks to high customer switching costs. We view more than 90% of Fortune 100 firms using Splunk’s offerings as a vote of confidence in its enterprise product lineup. Further, we are impressed by Splunk’s strong cloud dollar-based net retention, which has consistently remained above 120%. With the ability to land large customers and consistently upsell them, we remain confident in Splunk’s long-term growth prospects.

Business Strategy & Outlook

We believe Splunk merits a narrow moat rating owing to strong customer switching costs associated with its products. In brief terms, Splunk offers its customers a platform that can ingest, index, and analyze copious amounts of data while offering full-fidelity insights and monitoring. The two primary use cases for such a platform are security and full-stack monitoring. With a comprehensive suite of products that targets enterprise customers in both of these end markets, the value of Splunk's platform can be seen in both its clientele (which includes over 90% of the Fortune 100) and its impressive dollar-based retention metrics. With secular tailwinds and a comprehensive suite of inherently sticky product offerings, we believe Splunk is more than likely to generate excess returns over the next 10 years, therefore merits an economic moat.

We consider Splunk as a competitor in two key industries: security, via its SIEM and SOAR offerings, and full-stack monitoring and analytics, or FSMA, via its plays in the observability and IT analytics spaces.

Security information and event management companies typically ingest high volumes of machine-generated data, typically in the form of log files, and produce real-time analysis of a company's security infrastructure. Think of SIEM as a well-serviced alert system—whenever any irregular activity is detected, the SIEM software will put out an alert, thereby warning the IT team, ideally in real time. Receiving an alert for action is good only if the number of alerts remains at a manageable level. However, with the explosion in machine-generated data, primarily due to increased digital connectivity, the number of alerts to a typical IT security team can be overwhelming. Enter security orchestration, automation, and response, or SOAR; SOAR is the glove to SIEM’s hand. SOAR software allows an enterprise’s IT team a reprieve by using artificial intelligence to triage security issues, thereby leading to a substantially lower number of alerts that need to be dealt with manually. To contextualize this, Blackstone, using Splunk’s SOAR capability, reduced the mean time to resolution, or MTTR, for malware alerts from 30-45 minutes to 40 seconds. As machine-generated data continues to increase, we expect the SIEM and SOAR markets to soar. 

In our view, the SIEM and SOAR spaces are naturally conducive to the presence of economic moats. SIEM and SOAR products can swiftly become essential to business operations and security, thereby making the switch to another vendor painfully difficult. Further, the switch to another vendor may entail data loss or a security lapse, possibilities that further increase switching costs within the SIEM and SOAR space.

The full-stack monitoring and analytics, or FSMA, space is nascent, springing into existence as a method of unifying and coalescing disparate parts of an enterprise's monitoring framework. FSMA providers seek to give enterprises a one-stop shop to monitor their entire IT stack, ranging from application performance to logs to end-user experience. An important criterion within the FSMA space is a provider's ability to ingest large amounts of data, consolidate it, and then make meaningful inferences from it, leading to better business outcomes. The status quo before the emergence of FSMA was various providers focusing on specific parts of the IT stack. For example, an enterprise may have one company monitor its application performance, while another monitored its logs. This, naturally, led to inefficiencies as IT professionals coalesced the outputs manually to construct a meaningful picture of the overall infrastructure's health and performance. FSMA providers are now offering enterprise customers the ability to remove these data silos and monitor the entire IT stack from one consolidated platform. 

Splunk, as a player in both these spaces, has been able to provide value by using proprietary tools to distinguish itself from its competitors. Foremost is Splunk's ability to index large volumes of data, irrespective of its format. The ability to ingest unstructured data is a major distinguishing factor for Splunk. Through the company's "schema-on-the-fly" offering, Splunk offers its customers the ability to input unstructured machine data and derive meaningful insights from it. The increased flexibility has two major impacts on the IT workflow for an enterprise. First, it eliminates the need of standardization of machine-generated data to one specific input language, saving IT labor hours. Second, it allows for a larger set of analyses to be run on the data as unstructured data is not modified or altered to fit a certain form. 

Splunk's ability to ingest large amounts of data at a fast pace, via forwarders, allows it to store and analyze every single signal on a client's back or front end. This full-fidelity no-sample approach is another area of differentiation for Splunk among its peers. From elementary statistics, we understand that repeated sampling (if the samples are of an adequate size) results in an unbiased estimate of the mean. However, we still recognize that sampling errors exist, pushing the error rate to a nonzero value. The only way to resolve this issue is to effectively monitor every signal a.k.a. maintaining full fidelity. However, doing so requires an ability to ingest, index, and analyze much more data than repeated sampling—a feat Splunk has been able to accomplish. 

A good example of how enterprises can utilize Splunk’s product offering is one of Tesco, a leading global retailer. Splunk is embedded across more than 100,000 Tesco customer touch points, ingesting more than 33 terabytes of data daily. Splunk is embedded across the organization from customer support to order fulfilment. Using Splunk’s dashboard, Tesco is able to observe and monitor critical areas such as IT infrastructure health, the safety of customer transactions, and supply scheduling. Going forward, Splunk is assisting Tesco in the firm’s digital transformation. 

We consider Splunk’s economic moat a result of strong switching costs, which we can trace to Splunk’s entrenchment in a client’s business, and the efficiency gains related to keeping Splunk as the vendor for either security or monitoring needs.

We consider Splunk a leader in the SIEM space and we expect that status to translate into continued success in complementary SOAR. Humans exhibit loss aversion and by extension, so do enterprises. This, in our opinion, is particularly true in the IT security landscape. When switching SIEM or SOAR vendors, we believe that an enterprise faces operational risks, such as the loss of data during the changeover, project execution, and operational disruption. The more critical the function and the more touch points across an organization a vendor has, the higher the switching costs will be. 

We believe that any security-related data loss, disruption, or lapse is a material cost associated with switching vendors. We also do not think that enterprises nickel and dime their way to picking a SIEM or SOAR vendor—typically companies will pick the best product out there, provided that it has features most relevant to them. Once this product is deployed, which can take weeks of training and professional help, we rarely see instances of companies moving away from their security vendor. With regard to Splunk, this reality surfaces in multiple data points. The net dollar-based retention, or NDBR, a measure of upselling activity to existing clients netting out churn, is a best-in-class 130%. Further, annual recurring revenue, or ARR, expansion for clients over different time periods also point to clients not only sticking with Splunk but continuing to spend more on the company’s products and services.

As Splunk’s SIEM and SOAR enter a client’s ecosystem, Splunk is able to capture large swaths of data previously left untapped, because of its superior ingestion and indexing abilities. This data allows Splunk to continually improve its own dashboards, alert systems, and triaging frameworks for that client. As a result, if a client were to leave Splunk for another vendor with a baseline product as good as Splunk’s, they would have to start from nothing in building out those complex dashboards and alert systems. We view these efficiency gains as tools that further entrench Splunk into the customer’s ecosystem. This iterative process, once again, solidifies switching costs for companies that, as mentioned above, are picking vendors based on features, not simply price.

We view Splunk’s competitive positioning within the FSMA space as also moatworthy. To understand this competitive positioning, it is important to consider the size and scale of both Splunk’s customers and its own FSMA offerings. Splunk, as a business, has typically targeted large companies and big public sector organizations. The benefit of this strategy is obvious—while tougher to land than down-market players, larger companies are typically stickier clients. We observe this trend throughout our software coverage, and Splunk is no exception. In the marriage of Splunk’s FSMA offerings, which range from application performance, log, real user, and interface monitoring, with the size of its clients, we find the perfect mix of deep entrenchment leading to strong switching costs. As a company adopts Splunk’s observability suite along with its IT analytics offerings, we typically see a movement along the upselling schedule as Splunk is able to increase its impact within the company. As mentioned before, Splunk’s iterative learning processes learn from the company’s machine-generated data and are able to optimize monitoring, and drive business efficiencies. This is a multistep game, with each successful step entrenching Splunk’s offerings even more as technical users become more accustomed to the monitoring platform that continues to improve. Once again, we point to the retention and ARR expansion metrics listed above as an indicator of the company’s strength in executing against its land-and-expand model.

It is worth noting that any cloud transition brings along difficulty in customer retention. For example, Splunk may wish to move one of its existing clients from a term license over to a cloud-based deal. The client, rightfully so, may wish to only move over to Splunk’s cloud offering once the term license is close to expiry. As a result, there is a sweet spot in which the client can effectively move off Splunk’s platform onto a competitor’s without signing the cloud deal. More broadly, the company undergoing a cloud transition effectively opens the exit door but asks the client not to leave. We are impressed with Splunk’s execution of the cloud transition thus far as the company’s churn of clients moving from term to cloud is zero. That is to say that every time Splunk asked the client to stay, the client did. We think this metric demonstrates the stickiness of Splunk’s products that even when clients have an obvious time to leave, they do not. 

Looking ahead, we view Splunk’s new workload pricing model as the right step in the company’s land-and-expand strategy. In the past, Splunk would charge customers based on the amount of data ingested, or the data they were presenting for Splunk’s analysis/monitoring. With workload pricing, customers are paying for the actual analysis/monitoring, irrespective of the initial ingestion size. The difference between paying for either the input or the process is substantial. If there is no price to get data into Splunk, enterprises will import more data into Splunk. Once Splunk is able to access this data, the increased volume allows Splunk’s AI engine to continually improve itself, thereby improving the output whether it be in the security or FSMA space. With the improved output, and pricing, which is not as rigid as the amount of space allocated for ingestion, we see enterprises store and spend materially more on Splunk’s products after switching to the workload pricing model. We see this pricing model as creating more sticky products as Splunk is able to generate better insights into a firm’s operations, a direct result of the increased data input.

Narrow

Economic Moat

Splunk

Splunk, Inc. engages in the development and marketing of cloud software solutions. Its products include Splunk cloud, Splunk light and Splunk enterprise. It also offers solutions for Information Technology operations, security, internet-of-things, application analytics, business analytics, and industries. The company was founded by Erik M. Swan, Michael J. Baum and Robin K. Das in October 2003 and is headquartered in San Francisco, CA.

Earnings data Q1 2024

Revenue

Cost of revenue

Gross profit

Operating expenses

SG&A

Other

Operating income

EBITDA

Net income

Earnings per share

Total assets

Current assets

Cash & equivalents

Receivables

Inventory

Non-current assets

Net PPE

Intangibles

Total liabilities

Current liabilities

Short term debt

Income tax payable

Non-current liabilities

Long-term debt

Total equity

Stockholders equity

Minority interest

Total liabilities & equity

Total debt

Net debt

Book value per share

Cash from operations

Funds from operations

Change in working capital

Cash from investing

Capital expenditure

Purchase/sale of investments

Purchase/sale of business

Other sources

Cash from financing

Change in stock

Change in debt

Cash dividends paid

Cash from other sources

Net change in cash

Free cash flow

SAN FRANCISCO--(BUSINESS WIRE)--Panther Labs, the leading cybersecurity innovator for detection and response at scale, today announced the launch of its new Security Data Lake Search and Splunk Integration capabilities. These offerings mark a critical leap forward in managing security risks in today's cloud-first landscape. As organizations race to implement machine learning capabilities, they're increasingly reliant on decentralized, cloud-based data stores and workflows to power the developme.

Panther Unveils Security Data Lake Search and Splunk Integration to Redefine Detection and Response at Scale

SAN FRANCISCO--(BUSINESS WIRE)--Splunk Inc. (NASDAQ: SPLK), the cybersecurity and observability leader, is hosting its annual public sector event, GovSummit 2023, in the Nation's capital, bringing together government IT and security professionals to explore innovative strategies to deliver on the nation's cyber strategy. Event Details Date: Thursday, December 14, 2023 Time: 7:30 am - 4:30 pm ET Location: Ronald Reagan Building and International Trade Center, Washington, D.C. Agenda: View the co.

Media Alert: Splunk GovSummit 2023 - Delivering on the Nation's Cyber Strategy Together

COLCHESTER, Vt.--(BUSINESS WIRE)--NuHarbor Security, trusted managed security provider to hundreds of clients in both the public and private sector, has partnered with RavenTek, a top provider of leading-edge IT solutions to mission critical organizations worldwide, to offer a unified approach to Splunk security and IT observability to public sector clients. NuHarbor and RavenTek are both Elite partners in the Splunk partner ecosystem, and the combined offering encourages a cohesive and streaml.

NuHarbor Security Partners with RavenTek to Offer Streamlined Splunk Services

Cisco Systems

Intuit

Seadrill Ltd

Quite a few companies are standing out after blowing away their quarterly earnings expectations this week and alluding to the possibility of more upside in their stocks.

3 Stocks to Consider After Massive Earnings Beats

Healthy traction in the cloud business along with rising customer engagements, continuous innovation and a robust product portfolio help Splunk (SPLK) to beat third-quarter fiscal 2024 earnings estimates.

Splunk (SPLK) Beats Q3 Earnings Estimates on Solid Revenues

The headline numbers for Splunk (SPLK) give insight into how the company performed in the quarter ended October 2023, but it may be worthwhile to compare some of its key metrics to Wall Street estimates and the year-ago actuals.

Splunk (SPLK) Reports Q3 Earnings: What Key Metrics Have to Say

Splunk Inc (NASDAQ:SPLK) managed to top expectations on the top and bottom lines with its fiscal third-quarter results.  The data analysis software company posted adjusted earnings of $1.55 per share on revenue of $1.07 billion, compared to expectations of $1.12 per share on revenue of $1.03 billion.

Splunk rides cloud revenue growth to 2Q earnings beat

SAN FRANCISCO--(BUSINESS WIRE)-- #splunknews--Splunk Inc. (NASDAQ: SPLK), the cybersecurity and observability leader, today announced results for its fiscal third quarter ended October 31, 2023. Third Quarter 2024 Financial Highlights Total ARR was $4.0 billion, up 15% year-over-year. Total revenues were $1.067 billion, with Cloud revenue growing 26% to $469 million. GAAP Operating Expenses increased 4% year-over-year; non-GAAP Operating Expenses decreased by 1% year-over-year. Trailing twelve month operatin.

Splunk Announces Fiscal Third Quarter 2024 Financial Results

Splunk (SPLK) is expected to record a revenue expansion year over year in the third quarter of fiscal 2024 backed by healthy demand trends, product innovation and AI integration.

Will Healthy Revenue Growth Boost Splunk's (SPLK) Q3 Earnings?

Looking beyond Wall Street's top -and-bottom-line estimate forecasts for Splunk (SPLK), delve into some of its key metrics to gain a deeper insight into the company's potential performance for the quarter ended October 2023.

Gear Up for Splunk (SPLK) Q3 Earnings: Wall Street Estimates for Key Metrics

Adobe

salesforce.com

CrowdStrike

NVIDIA

Workday

Zscaler

The most upgraded stocks in November, the top seven listed on MarketBeat's platform, all have two things that aren't surprising in common. The first is that they are all monetizing AI.

The most upgraded stocks in November have two things in common

SAN FRANCISCO--(BUSINESS WIRE)-- #splunknews--Splunk Inc. (NASDAQ: SPLK), the cybersecurity and observability leader, today announced the expiration of the waiting period under the Hart-Scott-Rodino Antitrust Improvements Act of 1976 (the “HSR Act”), in connection with the previously announced agreement for Splunk to be acquired by Cisco (NASDAQ: CSCO) for $157 per share in cash. The expiration of the waiting period under the HSR Act occurred at 11:59 p.m. Eastern Time on November 13, 2023. The completion of.

Splunk Announces Expiration of Hart-Scott-Rodino Waiting Period for Proposed Transaction With Cisco

Splunk (SPLK) closed the most recent trading day at $146.80, moving -0.14% from the previous trading session.

Why Splunk (SPLK) Dipped More Than Broader Market Today

C3.ai

Amazon

Alphabet

Microsoft

The year 2023 is deemed a watershed moment for artificial intelligence (AI) as the sector continues to find applications across various fields. This burgeoning interest is underscored by the remarkable surge in market capitalization for leading AI companies, signifying a pivotal juncture in AI's trajectory and emphasizing the industry's immense potential.

$2.8 trillion pours into leading AI companies' market cap in 2023

In the closing of the recent trading day, Splunk (SPLK) stood at $146.62, denoting a +0.1% change from the preceding trading day.

Splunk (SPLK) Ascends But Remains Behind Market: Some Facts to Note

SAN FRANCISCO--(BUSINESS WIRE)-- #splunknews--Splunk Inc. (NASDAQ: SPLK), the cybersecurity and observability leader, will report results for its third quarter ended October 31, 2023 on November 28, 2023. Results will be included in a press release with accompanying financial information that will be released after market close and posted on the Splunk Investor Relations website. In light of the pending transaction with Cisco, Splunk will not be hosting an earnings conference call to review the third quarter.

Splunk to Announce Fiscal 2024 Third Quarter Results on November 28, 2023

The Zacks Style Scores offers investors a way to easily find top-rated stocks based on their investing style. Here's why you should take advantage.

Why Splunk (SPLK) is a Top Momentum Stock for the Long-Term

Hundreds of U.S. companies have slashed their workforces this year, including Amazon, Google, Meta and Disney.

2023 Layoff Tracker: Condé Nast, Splunk Cut Hundreds Of Employees

NEW ORLEANS--(BUSINESS WIRE)--Former Attorney General of Louisiana Charles C. Foti, Jr., Esq. and the law firm of Kahn Swick & Foti, LLC (“KSF”) are investigating the proposed sale of Splunk Inc. (NasdaqGS: SPLK) to Cisco Systems, Inc. (NasdaqGS: CSCO). Under the terms of the proposed transaction, shareholders of Splunk will receive $157.00 in cash for each share of Splunk that they own. KSF is seeking to determine whether this consideration and the process that led to it are adequate, or w.

SPLUNK INVESTOR ALERT by the Former Attorney General of Louisiana: Kahn Swick & Foti, LLC Investigates Adequacy of Price and Process in Proposed Sale of Splunk Inc. - SPLK

2023 Layoff Tracker: Splunk Cuts 560 Employees

Cybersecurity firm Splunk will fire about 500 employees, CEO Gary Steele said, adding that it was not a result of the $28 billion Cisco deal.

Splunk to cut 7% of workforce, or about 500 employees, ahead of Cisco acquisition

Splunk (NASDAQ: SPLK ) layoffs are on the way for the cybersecurity company's employees as it enacts a restructuring plan. According to a filing with the Securities and Exchange Commission (SEC), Splunk is planning layoffs that will affect 7% of its global workforce.

Splunk Layoffs 2023: What to Know About the Latest SPLK Job Cuts

Splunk Inc. SPLK said Wednesday it's planning to cut about 7% of its global workforce, mostly in the U.S. The company had 8,000 employees as of Jan. 31, according to its most recent annual report, suggesting about 640 employees will be cut. The software company expects to book charges of about $42 million for severance and other costs, as well as about $5 million in non-cash charges for share-based compensation expense, it said in a regulatory filing.

Splunk unveils plan to cut about 7% of its global workforce

Splunk (SPLK) closed at $147.16 in the latest trading session, marking a -0.03% move from the prior day.

Splunk (SPLK) Stock Slides as Market Rises: Facts to Know Before You Trade

The outlook for CSCO stock depends on trends for cloud computing, plus corporate and telecom networks amid the shift to remote work.

News for Splunk Stock (SPLK)