Q2 2024 Splunk Inc Earnings Call
Okay.
Okay.
[music].
Good afternoon, My name is Krista and I'll be your conference operator today at this time I would like to welcome everyone to the Splunk second quarter 'twenty 'twenty four financial results conference call.
All lines have been placed on mute to prevent any background noise. After the speakers' remarks, there will be a question and answer session. If you would like to ask a question during that time simply press star followed by the number one on your telephone keypad and if you would like to withdraw your question Press Star followed by the number one.
<unk>.
Thank you I will now turn the call over to Katie White director of Investor Relations. Please go ahead.
Thank you Krista good afternoon, and thank you for joining today's call with me on the call are Gary Steele, President and CEO and Brian Roberts CFO .
After market close today, we issued our earnings press release, which is also posted on our Investor Relations website, along with supplemental materials.
This conference call is being webcast live and following the call an audio replay will be available on our website on today's call, we will be making forward looking statements, including financial guidance and expectations, including our growth and profitability forecast for our third quarter and full year.
2024, and our future expectations of revenue total air our cloud mix non-GAAP operating expenses non-GAAP operating margin free cash flow free cash flow margin.
<unk> D V and our our cloud gross margin equity compensation, you said and liquidity as well as trends in our markets and our business, our strategies and expectations regarding our business.
Hi, acquisitions products technology customer demand and regulatory environment. These statements are subject to risks and uncertainties and are based on our assumptions as to the macroeconomic environment and reflect our best judgment based on factors currently known to us.
Actual events or results may differ materially. Please refer to documents, we file with the SEC, including our Form 10-K, and 10-Qs as well as the form 8-K filed with today's press release.
These documents contain risks and other factors that may cause our actual results to differ from those contained in our forward looking statements.
These forward looking statements are being made as of today and we disclaim any obligation to update or revise these statements if.
If this call is reviewed after today the information presented during this call may not contain current or accurate information.
We will also discuss non-GAAP financial measures, which are not prepared.
In accordance with generally accepted accounting principles.
A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.
With that let me turn it over to Gary.
Good afternoon, and thank you for joining today's call to start Splunk delivered a solid second quarter through our ongoing focus on execution operational discipline and customer engagement, we met or exceeded each of our guided metrics in Q2, I'm really pleased with these results and wanted to thank the entire splunk team for their hard work.
<unk> and commitment.
At the same time, we further accelerated splunk innovation to help our customers achieve resilience across their digital system through a series of important and exciting announcements.
Cover our financial results first.
Joining splunk 16 months ago, we've been executing to drive long term durable growth with increasing profitability. Our Q2 results yet again showcase our ability to deliver on that strategy, particularly through our free cash flow growth, which we believe are the best top and bottom line metrics of the help.
And strength of our business.
In Q2, we grew total IRR to 385 $8 billion.
At 16% year over year increase exceeding the guidance, we shared on our last earnings call by over $30 million.
Claudia are increased 27% year over year to 191 8 billion.
And our Q2 total revenue grew to $911 million, a 14% year over year increase well above our previously guided range.
We delivered our topline growth, while maintaining a sharp focus on operating efficiency and controlling costs.
Fact that focus enabled us to reduce non-GAAP opex by 3% year over year, which is significant given that we previously anticipated an increase of between two and two 5%.
What's more we exceeded expectations for free cash flow in Q2, delivering positive 4 million nearly $20 million above our guidance.
Given our considerable progress on driving more efficient growth, we are increasing our full year outlook for free cash flow, Brian will share our updated guidance shortly.
We're proud of what we delivered this quarter, even as the uncertain macro environment remained largely consistent with what we've seen throughout this year.
Our Q2 performance clearly demonstrates that we have dialed in our ability to navigate the current landscape and execute with consistency to deliver durable growth and profitability.
What is also evident is that organizations around the world need Splunk as a world class unified security and the durability platform more than ever to underpin the resilience of their digital systems.
Since becoming CEO one of my top priorities has been to increase the pace of our innovation.
As the technology landscape evolves and becomes more complex organizations need to see and understand what's happening in their environments in order to keep their systems safe and reliable.
In the simplest sense, if you cant see it you cant secure it.
Can keep it up and running either.
I hear time, and time and again from CFO , CIO and CTO that Splunk is commitment to providing comprehensive visibility into and across environments is critical in today's hybrid multi cloud world.
I'll spend the next few minutes sharing how we're deepening that commitment by taking you through what we announced in July .
Annual user conference Dock Cop 23.
During your last earnings call I spoke about our enthusiasm that AI would fundamentally transform the way organizations keep their digital systems secure and reliable given splunk flexible and highly scalable data architecture, our industry, leading security and edge server ability solutions and our quickening pace of innovation, we are in a unique.
<unk> positioned to help enterprises bolster resilience by harnessing AI across our product portfolio.
<unk> Dot cop 23, we unveiled the next step and how spark is bringing AI to bear across security and observe ability.
<unk> is a collection of new and existing AI powered offerings that combined automation with human in the loop experiences. So organizations can drive faster detection investigation and response, while controlling how AI is applied to their data.
By optimizing domain specific large language models and machine learning algorithms built on security and observe ability data Splunk AI frees up security and engineering teams for more strategic work, helping to increase productivity and lower costs.
In addition, we're applying AI to help teams accelerate time to value through assisted intelligence, our new Splunk AI assistant Leverages generative AI to provide an immersive chat experience and helps make our search processing language or SPL easier to use by enabling the use of natural language to create SPL queries.
We're excited that Splunk AI will continue building on our track record of innovation in AI and ml. This includes our recently launched App for anomaly detection that uses ml and are widely used machine learning tool kit looking forward, we see broad opportunities to further apply AI to make our core platform and premium products that much more.
Power ball through advanced functionality.
At <unk> comp. We also introduced many new products and features that empower security and engineering team with unified experiences and workflows. So they can detect investigate and respond to threats quickly accurately and at scale.
In security, we announced multiple new features for our award winning enterprise security and server products and we also announced the general availability of Splunk attack analyzer, which integrates the capabilities, we acquired from twin wave last year into our unified security operations experience.
<unk> analyzer is already being used by some of the world's largest companies to analyze threats, including those that employees reported as suspected phishing E mails.
Through an integration with Splunk sore customers that are using splunk attack analyzer and sore can fully automate threat analysis process to ensure accurate and timely detections, while reducing the time and resources typically spent doing manual investigations.
We also shared our continued delivery on our unified security Operation Center vision, which aligns to the threat detection investigation and response or TD IR framework.
Cornerstone of our approach is Splunk mission control, which brings together security and security analytics automation and orchestration and threat intelligence capabilities under one common work surface empowering security teams to stay ahead of cyber threats.
By unifying and simplifying and modernizing how splunk is used in the sock, we're helping teams overcome the challenge of having too many disparate tools too little time, and non stop threats alerts coming across their console.
On the durability side, we were named a leader in the 2023 Gartner Magic quadrant for application performance monitoring and observe ability. This recognition builds on our nine consecutive times of being named a leader in the 2022, Gartner Magic quadrant for security information and event management to today.
Splunk is the only vendor to be named a leader in both of the Gartner Magic quadrants.
Our goal is to create a single unified experience for security and engineering teams across security and observed ability.
To that end, we continue to unify splunk observed ability cloud with the Splunk platform. In 2022, we have a lot we launched Splunk login server connect enabling observer ability cloud users to seamlessly use theirs.
Enterprise as one cloud platform data, we didn't stop there in Q2, we previewed the open telemetry collector as a technical add on which provides customers with a unified view of their infrastructure and services.
We also launched unified identity to give our customers a better user experience as they access data from the Splunk cloud platform and Splunk Absorbability cloud without the need to authenticate multiple times.
Looking ahead, we're continuing to invest in the enterprise grade observer ability solutions organizations need to monitor and troubleshoot across the entire tech stack.
Our gating factor in our innovation is is a belief that organization shouldnt be locked into one environment and should have choice in how they architect their systems across the multi cloud hybrid world.
We're continuing to find ways to make sure that sponsors available natively to customers in the cloud environment that works best for them.
That's why one of the most exciting announcements at Dot comp was our new strategic partnership with Microsoft to build Splunk.
<unk> solutions natively on Microsoft Azure.
Together, our approach will enable our joint customers to migrate modernize and grow their environments with end to end cloud and hybrid visibility at scale.
In addition organizations globally can now purchased Splunk enterprise Smart enterprise security and Splunk, It service intelligence and the Azure marketplace.
We're pairing thousands of our joint customers with best in class solutions, and I am glad to share that first transaction closing Q2 was a boomerang customer returning to Splunk.
The flexibility and value our approach provides.
Another area, where we're continuing to invest in driving innovation at the edge given the explosion of data processing information on the edge has become a critical priority both for Splunk and our customers last quarter, we launched Splunk edge processor, which helps our customers process data at the edge to increase visibility and control over their data.
Before it leaves their network and helps ensure that it ends up at the right destination in the right format. We know this is an essential capability and we are proud to offer edge processor for free to our spunk cloud customers.
As edge processor is adopted by our customer base, we believe it will significantly reduce the need for customers to leverage external vendors to pre processor data related to this a few of you have asked us about our ongoing lawsuit against cripple, Although my ability to comment on active litigation is limited I can tell you that the litigation is.
Very active and the case is scheduled to go to trial in April of 2024.
You may recall that this case is about criminal taking in a legally using our intellectual property and indeed cripple has conceded that a reverse engineered features in Splunk software. Our case is strong and we look forward to continuing to prove it shifting back to our edge innovation.
Another exciting announcements during the quarter was <unk> edge hub, which provides more complete visibility across it and ot environments by streaming previously hard to access data directly into the Splunk platform.
For manufacturers factory floors server rooms, and more edge had simplifies the ingestion and analysis of data generated by sensors, Iot devices, and industrial equipment, enabling advanced monitoring investigation and response.
<unk> is sold exclusively through our go to market partners, who bring deep industry expertise on our customers' Ot environments and I am pleased to share we're seeing compelling customer use cases from early adopters. For example, a multinational manufacturing company uses edge hub to interface with their production systems to collect.
Machine data to classify defects.
With over $1 million annual consumer device production capacity this organizations continuously looking for incremental quality improvement opportunities to save costs.
And assess factory expansion needs for increases in customer demand after deploying edge hub. The organization achieved a reduction of approximately 70% and defective parts during their QA process, resulting in more than 20% labor cost savings associated with otherwise scrapped or rework.
<unk>, we're excited to have once again broken down a barrier for our customers to gain more visibility into their data and we're looking forward to building on that chubb's early success.
Let's change gears and highlight the continued demand we're seeing from customers around the world. We ended Q2 with 834 customers with $1 million or more in <unk> up by 24 since just last quarter. This includes 452 customers with cloud <unk> over 1 million.
Which is up by 100 year over year from the 352 cloud customers with.
<unk> over $1 million in the year ago period.
Our team landed many significant deals in Q2 that illustrate our growth our growth levers and the breadth of value we bring to the largest and most complex global enterprises I'll start with observer ability since 2018, we built acquired and integrated what we believe are the best technologies to help enterprises monitor opera.
And improve their hybrid technology environments are rapid innovation and investments in the observer ability are paying off for Splunk and our customers. We're continuing to win significant deals and displace leading competitors by operating customers comprehensive the durability solutions in a unified experience.
During Q2, we were pleased to secure at seven figure observe ability deal and extend our footprint within a leading U S financial services organization.
This customer needs to close the visibility gaps and requires a complete hybrid platform solution that eases resource constraints and consolidate their observed ability tools and cost as they prepare to move more than 150 applications to the cloud we were already their trusted security provider and through a technical proof of concept we demonstrate.
Not only that observed ability features needed for their transformation and full visibility, but also the baidu platform integration capability to complement their existing uses splunk and help them avoid tool sprawl data silos and ways.
In Q2, a U S based multinational conglomerate and longstanding hybrid security customer significantly expanded their use of splunk by shifting more of their workloads to cloud and through its a new seven figure three year observer ability deal for their new health care Division and cloud stack.
They chose splunk observe ability over competitive options because of our ability to drive lower total cost of ownership and because our differentiated capabilities offer full visibility.
By using not only metrics and traces but also underlying logs, helping enhance resilience by proactively preventing outages, while also monitoring critical infrastructure and applications.
The market for observed ability, it's growing rapidly and only Splunk has the integrated enterprise grade solutions needed by the <unk>.
And engineering teams at the global 2000 to keep their services up and running.
Now turning to security that's joined Splunk I've led the team to deliver better outcomes and more value to our customer security leaders by making the work of their security teams that much more effective and efficient during the quarter. We continued to see strong demand for our industry, leading Sim and premium security.
<unk> needed in the modern sock in Q2, we secured a significant cloud deal with a global leader in transport and logistics. Following a competitive selection process. This European Europe based organization chose Splunk to support and consolidate as complex security needs on a global level.
Seven figure Splunk cloud and Splunk Enterprise security deal displace the legacy Sim competitor and as a result of our growing strategic partnership to help them drive resilience through our single unified platform.
We also secured a new logo win during Q2 in Europe for Splunk cloud and Splunk Enterprise security with a global automotive technology company the.
The customer chose splunk over competitors due to limitations in their legacy Sim and because of our ability to provide full visibility across all of its data sources from over 150 sites globally. The organizations as the organization is expanding rapidly in software development and with 200000 employees now.
On Splunk to keep their systems safe and reliable as they scale.
Our public sector momentum also continued in the quarter with an eight figure security expansion and renewal with a large U S. Federal agency that is all in on Splunk. They have centralized their modernization and cyber security operation strategy around Splunk and are also delving into both AI ops and <unk>.
With us.
As of Q2, they ingest 30 times more data per day than they did in 2019, leveraging hundreds of same use cases as well as several several of our premium applications, including nearly 50 store automation playbooks.
Our work with government agencies is incredibly important and we're proud of our partnership with this agency to advance their security operations to keep public information safe from threat actors, while ensuring a world class user experience across several applications.
Looking ahead it security, we fundamentally believe that Splunk will continue to play a critical role in helping organizations navigate this evolving cyber security landscape.
One important example, where our innovation and security leadership will be essential it's helping our U S. Public company customers comply with the SEC recently announced rules on cyber security incident disclosure that will be effective later this year with a four business day window to report once the cyber security incident and his team.
<unk> timely response is essential.
Strength is detection and response and the investigative capabilities. We provide can help customers quickly gather and analyze telemetry from various tools and sources to classify an event and determined if it's material and requires SEC reporting our ability to see across the vast quantities of data helps organizations quickly.
We understand not only if something happen, but also how it happened.
We believe our security solutions will be even more critical as organizations invest.
And broader resilience strategies to mitigate future cyber threats and improved visibility into their it infrastructure and accelerated detection and response. This is yet another dimension of value, we bring as a strategic partner to our customers executives as the cyber security landscape evolves.
Finally, our customers can continue to tell us there is incredible value when they utilize both security and observe ability to solve their complex visibility challenges during the quarter, we deepened our strategic partnerships with many organizations on their path to greater resilience through unified security net serve ability.
We secured a seven figure security an observer ability deal in Q2 with a multinational banking and financial services company headquartered in the Asia Pacific region. This milestone renewal and expansion deal took place in a highly competitive landscape and it represents the deep level of engagement and our partnership over several years.
Ears.
Previously transitioned this organization from on Prem to the cloud and now our momentum continues as they double down on our security and implement monk observed ability to meet their evolving needs to wrap up I want to reflect on the journey Splunk is and I have been on for the past 16 months when I joined Splunk. My thesis was that we could access.
<unk> Splunk has 20 years of industry leadership to deliver even more exceptional customer and shareholder value.
<unk> led the team to build more executive level customer relationships, we are a vital strategic partner to customers worldwide and we are focused on serving their expanding needs by increasing the pace of innovation along the way we have cultivated the leadership and talent needed to drive durable growth with increasing profitability.
Our results demonstrate that my thesis is proving out in that Splunk is the key to enterprise resilience.
You again for joining today's call now over to Brian to walk through our financial results and outlook. Thanks, Gary So, let's get to our financial review and outlook. We continue to successfully navigate this economic backdrop and close a solid quarter as we exceeded or met our outlook across all guided metrics, we increased total <unk> by <unk> <unk>.
16% year over year to 385 8 billion.
Above our prior outlook of 15% growth.
Cloud <unk> increased 27% year over year to 191 8 billion.
Cloud <unk>, which is a trailing 12 month metric was 116% which was in line with our expectations remember cloud migrations began to slow in July of last year, which impacts. This trailing 12 month metric in terms of mix. The cloud portion of Q2 software bookings came in at 64 <unk>.
<unk> near the top end of our quarterly outlook of between 55 and 65%.
Q2, total revenue increased 14% year over year to $911 million ahead of our guidance range of between 880 $895 million.
Cloud revenue increased by 29% year over year to $445 million.
With regards to cloud gross margin, we continue to make progress on our efficiency initiatives Q2, non-GAAP cloud gross margin reached 73, 8%, an all time quarterly record, which is up nearly 450 basis points year over year and better than our outlook.
Now, let's move to operating expenses Q2 was a milestone quarter. It was a showcase of our strong collaborative execution, we ask teams to find new unlocks and they rose to the challenge they identified new opportunities to reduce third party spend as well as expand scope for team members, which helped us decrease cost and increase.
Operating efficiency.
As a result, we were able to reduce non-GAAP opex by 3% year over year instead of the previously expected increase of between two and two 5%.
We achieved this while growing <unk> by 16% year over year ahead of our outlook.
This significant cost leveraging combined with our revenue beat helped us exceed our guidance on non-GAAP operating margin in Q2, we achieved a 16, 7% non-GAAP operating margin, which was 470 to 670 basis points above our guidance of between 10 and 12%.
Let's move to free cash flow remember Q2 is seasonally impacted given it follows are typically slowest bookings quarter, which has historically led to negative quarterly free cash flow in Q2, we exceeded expectations and generated $4 million of positive free cash flow, which is $19 million ahead of our guidance.
<unk>.
Given the seasonality of bookings, we recommend that investors evaluate free cash flow on a trailing 12 month basis, which totaled $805 million at the end of Q2, nearly quadruple the $216 million generated over the 12 months ending July 31 2022.
Before I move to guidance I am pleased to announce that we will host our investor and analyst day in New York City on January nine we are excited to share our strategy long term targets and capital allocation plan with you more details will follow as we approach the date.
And with that let's turn to guidance. The current selling environment remains uncertain. We continue to experience increased scrutiny on deals as well as delayed cloud migrations that said, we're pleased with our first half execution navigating this macro backdrop based on our progress to date, we are increasing the low end of our <unk>.
Look to for $1 5 billion.
In terms of the high end until we see a positive change in the macro environment. We believe it's prudent to hold it unchanged at $4 $1 75 billion.
Separately, we are increasing our annual revenue outlook to a range of between $3 92, five and $3 95 billion.
Up from our prior single point estimate of $3 9 billion, an increase of $25 million to $50 million.
Please recognize that duration mix of term contract volume could significantly impact our reported revenue and associated growth rates I want to remind investors that our software license revenue related to term contract volume is recognized upfront. Thus GAAP revenue is highly subject to both bookings mix and contract duration as a reminder, we.
Believe <unk> is a better topline indicators since we bill both cloud and term software license customers on an annual basis.
So, let's move to expenses and the impact on free cash flow, we remain laser focused on improving our margin profile. We made outstanding progress in the first half and looking forward, we remain extremely focused on unlocking additional savings and efficiencies.
As a result, we are updating our annual expense guidance as we now expect to manage annual non-GAAP opex growth below our prior outlook at.
At the beginning of this fiscal year, we provided an outlook for annual non-GAAP opex growth of 7%.
Last quarter based on Q1 progress, we changed our guidance to between five and 6% growth and we now have a new outlook. We expect that we could hold non-GAAP opex growth in fiscal 'twenty four to approximately two 5%, which represents a 450 basis point improvement from our original outlook at the beginning of the year.
And a 300 basis point improvement from the midpoint of our outlook provided just one quarter ago.
In terms of the impact on margins, we now expect our fiscal 2004 non-GAAP operating margin of between 21, and 21, 5% up 300 basis points from our prior guidance range.
Based on our successful expense management, we're also increasing our annual free cash flow forecast by an additional $50 million. We now expect to generate free cash flow between 855 and $875 million in fiscal 'twenty, four which represents a year over year increase of between one.
100, and 105% from the $427 million generated in fiscal 'twenty three.
As a percentage of IRR. This would represent a free cash flow margin between 26, and 21% up from just 11, 6% in fiscal 'twenty three.
Let's move to near term guidance in Q3, we expect to grow <unk>.
By over $120 million to $3 $98 billion.
Which represents 15% year over year growth.
With regards to bookings mix, it's important to note that the U S. Public sector has historically had an outsized impact on our business in Q3, given the federal fiscal year end of September 30th and typical purchasing patterns.
The majority of our public sector business remains on Prem and they expect to renewals and expansions in Q3 will impact the cloud mix of software bookings. So while we continue to expect the cloud mix of software bookings will range between 55, and 65% each quarter, we will likely be towards the bottom end in Q3 after reaching the top end in <unk>.
You too.
Trailing 12 month cloud DVR or should tick down by approximately 400 basis points and roughly stabilized in that vicinity for the remainder of the year.
I am pleased to share that we now expect to achieve an important milestone early.
We previously indicated that cloud services would represent the majority of total <unk> in the second half of the year.
We now expect to achieve this during Q3.
Let's move to revenue, we expect revenue between 1.02, and 1.035 billion in Q3, representing year over year growth of approximately 10% to 11%.
With respect to non-GAAP cloud gross margin, we expect it will be relatively flat quarter on quarter as we focus on improving service levels and customer experience. This would still represent approximately a 100 basis point improvement year over year.
We continue to expect that we can achieve non-GAAP cloud gross margins of roughly 74% in Q4.
We expect Q3, non-GAAP opex growth to range between four and 5% year over year as we begin to comp some of the cost actions. We took last year. This opex growth translates into an expected Q3, non-GAAP operating margin of between 24, 7% and 25, 3%.
Let's move to cash flow in Q3, we expect to generate $75 million of free cash flow. This implies free cash flow of $834 million for the 12 months ending October 31, 2023, which is nearly triple the $287 million of free cash flow for the 12 months ending October 30.
<unk> 2022, we then expect to generate approximately $300 million of free cash flow in Q4 again for the full year, we expect free cash flow between 855, and $875 million, which is an increase of $15 million compared to our guidance range provided last quarter.
Let's move to equity.
As I mentioned last quarter, we're taking deliberate steps to reduce equity dilution in fiscal 'twenty four we expect to meaningfully reduce equity burn relative to fiscal 'twenty three and this will benefit future SBC expense since it's a lagging indicator in terms of what we can control in Q2, we reduced equity usage by.
Really 50% versus the year ago period.
Finally, let me spend a moment on capital allocation. We ended Q2 with over two 4 billion of cash cash equivalents and short term investments.
We have elected to redeem the 2023 convertible notes and cash next month, but on a pro forma basis, we will continue to have significant liquidity.
We will share more details of our capital allocation strategy at our Investor and analyst day in January .
So in closing we remain intently focused on creating shareholder value by driving durable long term growth and increasing our free cash flow and free cash flow margin. Despite a challenging macroeconomic environment execution. In Q2 was solid we delivered strong results across the business, including exceeding our outlook on the <unk>.
Top and bottom line with that let's open it up for questions.
If you would like to ask a question. Please press star one on your telephone keypad.
First question comes from the line of Matt Hedberg from RBC Capital markets. Please go ahead. Your line is open.
Great. Thanks for taking my question guys, Gary and team Congrats on the results really really good to see the momentum on both the top line and certainly the bottom line.
It looks to me like you grew net new <unk> really for the first time in a couple of years, obviously great to see.
When you think about momentum into the second half and even next year.
How do you expect to build on this success and I guess, specifically outside of macros, which remain so it feels like it's stable here what are the most important things that we should think about that could perhaps supply further acceleration as we look out into the second half of next year.
Yes.
Yes, great question, Matt So when we look at the business today, we continue to see tremendous strength in our security offerings and people are modernizing their stocks thinking differently about how they want to run their stock and we're playing an integral role there new capabilities like.
Attack analyzer or things like that have been really well received by our customers and by prospects and then more broadly the advantage that we have bringing security and the durability together, we're giving our customers the opportunity to standardize on a single platform and save money and what has been a challenging economic time for folks. So I think we're well positioned what we saw.
In the quarter, we think continues through the second half and into the coming year and as we've described before where we're excited about growth opportunities outside the U S and you heard it in a lot of the prepared remarks with the customers that we close we're seeing very good traction in markets, where we're relatively new.
And so we feel like we have a lot of good momentum coming out of this quarter going into the second half and we think it's a good setup as we as we contemplate next year.
Great to hear thanks, a lot.
Your next question comes from the line of Brent <unk> from Jefferies. Please go ahead. Your line is open.
Gary can you characterize the demand environment, what youre seeing now versus perhaps six to nine months ago things started to improve stabilize or if they are stable is just better execution on your end.
A quick follow up on Brian on expenses, and where you continue to see the most leverage you had in the operating margin expansion.
Thanks.
Yes, Hi, Brett.
I think there's a couple of things I think one is while we continue to see a high level of deal scrutiny, we see cloud migrations continue to be.
Hopefully reviewed it stabilized in the sense I think we understand what that environment looks like I think we're executing extremely well in this particular environment.
I would say the macro environment is pretty much the same of what we see in the entire year as we mentioned in the prepared remarks, but I think we're executing well within that.
Yes, Brett this is Bryan in terms of the expense question I would say look we made.
Very important progress in the first half of the year and looking forward, we're going to continue evaluating opportunities to increase our efficiency and speed of execution, we should always be focused on identifying savings as we scale. It's just what good businesses do.
As I shared in my prepared remarks, Q2 really was a milestone quarter as we reduced opex, 3%, while we grew.
16% year over year and as we look forward, we're going to continue to see opportunities to drive leverage. So we increased our free cash flow margin for the year.
As we plan to limit Opex growth to just two 5% and this is the second quarter in a row that we've increased our outlook for fiscal 'twenty four free cash flow margin.
Great. Thank you.
Your next question comes from the line of Brad Zelnick from Deutsche Bank. Please go ahead. Your line is open.
Great. Thank you so much congrats guys really really great results and it's great to see the cloud strength at the higher end of your expectations as a percentage of bookings, but Bryan your comments suggest you still face macro headwinds.
And we should expect lumpiness from quarter to quarter. So so not totally out of the woods, yet, but can you expand on the cloud migration trends that you see what type of customers are moving over which might be more resistive and housing in any way are you adapting incentives to get customers over to Paradise.
Yes, I would say first of all at a high level. We were very pleased with Q2 again coming in at 64% of our software bookings in terms of the mix in terms of cloud.
I would say from a cloud migration perspective, the trends that we've seen really since July of last year have remained relatively consistent we haven't really seen much difference.
And so I think I think it's important for folks to realize again cloud <unk> as a trailing 12 month metric.
But we do expect that that.
Metric will stabilize in Q3, and Q4 are probably about 400 basis points below where we are and Brad. The one other thing I would add is.
The.
Roy I am going to cloud continues to be extremely compelling.
So I think we're telling that story well and I think we're doing everything we can to ensure that customers understand that value because the reality is.
Companies today, they want their teams getting great outcomes response, they don't want them managing block and so this this opportunity getting people go cloud allows teams to focus on those great outcomes and I think we're telling we're continue to tell that story, even better all the time and I think that momentum is showing up in the numbers.
Excellent guys. Thanks for taking my question.
Your next question comes from the line of Raimo <unk> from Barclays. Please go ahead. Your line is open.
Two quick questions and congrats from me as well.
If you think like since you started there has been a few changes in terms of how you sell in terms of more of a single selling model.
More outcome based selling kind of refocusing on the a little bit more on security again.
Like where are we on that journey in terms of the whole C. This organization kind of being kind of India and seeing also the benefits as part of that is that part of what's going on here with the better results.
Ryan.
If you think about the cost takeout because obviously the next question comes is like when you take out cost budget grew better than almost seems too good to be true like in terms of what youre doing there like where are we on that journey of like taking stuff out that actually doesn't really support revenue and hence there is a lot more fat in the organization. Thank you.
Yes.
Raimo So a couple of things one is the.
The move to a single seller model that we did in October of last year has proven to be a really good outcome I think it's better for our customers I think it makes us more efficient.
And then aligning the resources to support those single sellers is something that we did relatively quickly and so I believe what youre seeing today in our numbers is the.
The efficiency of that really playing out.
And I think we're delivering very good outcomes to our customers as a result of it so I feel good about where we are in the evolution of that change and the impact that is having with our customers.
And I'll, let Brian answer the rest of that sure and I think in terms of our strategy look we're pretty consistent here, we want to increase efficiency and speed of execution. If you zoom out and look at the year we are.
We are increasing our investment in the sales and market sales and marketing and our go to market.
Area to expand especially in our international presence improving some of our coverage ratios and really position splunk to win in new accounts.
And then on R&D.
We're continuing to make R&D investments under new leadership and I Hope you got a sense from dot com that we've really accelerated our pace of innovation. We just we're coming more efficient as we increased hiring in our global talent centers.
And if you look at the R&D trends, we had a cost action in Q1, but in Q2 R&D grew faster than any other expense category on a sequential basis and we expect this trend to continue in Q3.
Okay perfect. Thank you congrats.
Thank you.
Your next question comes from the line of Andrew Nowinski from Wells Fargo. Please go ahead. Your line is open.
Okay. Thank you congrats on a great quarter, so I wanted to ask about the.
The partnership with Microsoft.
Coming off your user conference that you announced that you mentioned the first win already was a boomerang customer I was wondering which vendor.
They replaced to come back to Splunk.
Why did it take the partnership with Microsoft to convince them to come to Splunk, I guess I'm, just trying to understand how applicable.
<unk> thought process is to the rest of the customers in Azure that you might be able to to flip.
Yes, no great question I think what we what we've seen and the feedback we've gotten the impetus for us to go drive that relationship with Microsoft was really driven by the customer feedback both Splunk and Microsoft we're getting and I think there is this because there's a lot of data that lives in azure that people wanted to have splunk.
<unk> available there the real opportunity for us is to get to a native salute NATO spoke solution on Azure, which we believe will have within the next 18 months and that initial transaction that we saw I don't have all the details actually of that I think it's just the simple opportunity as someone.
Wanting to be able to leverage their credits, having an experienced in splunk and that momentum than carrying through to a very quick transaction, but I think there is a very positive sentiment.
The combination of Splunk and Azure.
Great. Thanks, Gary.
Your next question comes from the line of Rick <unk> from Baird. Please go ahead. Your line is open.
Okay.
<unk> Your line is open.
Your next question comes from the line of Keith Weiss from Morgan Stanley . Please go ahead. Your line is open.
Thank you for taking the questions. This is Sandeep Singh in for Keith.
Quick one from me on the back of a lot of product announcements on this.
Security side and on the agenda.
<unk> posted comp conference here is there any changes in sort of pricing and packaging and sort of go to market motion behind the pick up.
The capabilities as we look into the back half and into calendar 'twenty four.
There is no price changes obviously these new capabilities represent additional add on capabilities that customers can purchase but the basic pricing structure, how we're going to market. We're basically taking these new capabilities and putting them through our existing structure.
That makes sense that makes complete sense and then just as a follow up you mentioned a number of unified security and observing observe ability wins in Q2, who is actually making the purchasing decision is this being handled by the leadership of the Doc team or this is being handled by more of the.
Centralized platform or the operations teams is sort of leading the charge on making these architectural decisions.
Yes, no great question and typically and then we could go through the details on a couple of these deferred customer wins that we talked about typically we've anchored in with the C. So we have great acceptance broadly across the security team and then it spreads into broader I T.
Observe ability sale typically then gets driven by a combination of CIO CTO and under CTO is typically ahead of operations, it's the collectively across those folks.
So it's not a decision is not being made by security. It is basically we're getting the endorsement and handoff from security, but it's getting made centrally.
In that CIO CTO head of operations area.
It makes complete sense, hey, congrats on the return to net positive.
Thanks.
Your next question comes from the line of Jacob Real Barish from William Blair. Please go ahead. Your line is open.
Hey, Thanks for taking my questions and congrats again on the great quarter.
Helpful commentary on the Triple lawsuit and what Youre doing with your edge processor to to maybe help combat some of those potential competitive threats I'm curious what you've seen on the adoption front for that product from your existing base just given it's free for cloud customers and kind of how they're how they're parsing out the data distribution with that product.
Yes, no great question. It's relatively early people are excited because they like the idea of not having to pay yet another licensee for something sitting around Splunk and so I would say the reception has been very positive, but I would also say it's early.
Helpful. Thanks for taking my questions.
Your next question comes from the line of Rob Owens from Piper Sandler. Please go ahead. Your line is open.
Yes. Thanks for taking my question wanted to build on the unified security observe ability questions from earlier, maybe understand just where you are in terms of that process. Realizing it's early but any metrics you can share in terms of security customers versus observe ability customers I think more importantly, where you've landed with both or <unk>.
Cross sell both cross sold both excuse me, what's this doing to deal size and how do the new AI capabilities potentially accelerate this if at all thanks.
Yes, no great question, Rob So the motion that we're running today is we're going to existing security customers, where we have a strong anchor strong set of relationships. We are using those relationships been to get to that broader central it organization either as CTO.
Sometimes.
Vice President of operations, and we're showing them the value and opportunity at thinking about tool consolidation typically and literally every customer that I talked to they have.
Tens of quote monitoring tools using old words, but that's what they oftentimes have and theyre trying to figure out.
In this world where their digital footprint is growing rapidly how do they get a single architecture that enables them to scale of that broad digital footprint and so you can't have a million different tools, all doing different things and so we run a broad play that enables us to show the value of Splunk and the value that you get by bringing the observe.
The ability Claudia and integrated with the core platform and how you can derive better resilience as a result of that so that's the play we've been running and we we enter we start with the base of security and we moved to observe ability versus the other way around and I'll, let Brian comment we don't we haven't published any <unk>.
Metrics there may be some other ways to think about that.
We look at the attach I think we feel good about the momentum there, but I think back to Gary's point, when we can sell successfully sell unified security observed ability. It helps obviously increased and it just makes that relationship even more sticky and I think one thing that we saw in Q2.
Our renewal rate increased year over year, which we feel great about.
Alright. Thanks.
Your next question comes from the line of Joshua Tilton from Wolfe Research. Please go ahead. Your line is open.
Hey, this is Patrick on for Josh Thanks for taking my question.
You all talked pretty extensively about your own directives to drive cost efficiencies and we've obviously heard a lot about it optimizations across the industry.
From your perspective have you seen customers looking to optimize their spend on spot whether it be with log ingestion or on the observer ability side and then also on the observer ability side do you find that you're replacing other vendors more often or.
Homegrown solutions or is it kind of a mess.
Thanks.
Yes.
I think in this economic time, I think customers broadly are looking at how they can overall optimize costs. So I think that that is definitely a conversation.
A few things to note one is when customers say, hey, I feel like my Splunk those big what can you do to help me, we really talked through our our overall strategy, which is how do you think about your data and where it lives. So through our Federated search capabilities, we allow people to get access to data wherever my live. So you can then.
Strategically about where is the lowest cost place for storage. Good example is that as as three where we support Federated search onto S. Three and then coupled with that edge processor or one of the core capabilities of that solution is to reduce the level of data.
We go we lean into those conversations and really help our customers think through where they can optimize and save money and then as you extend that broadly and that durability as I mentioned before the Mattikalli, we see lots of tool consolidation.
Kinds of opportunities, where the outcome is reduced spend of vendors and we're leveraging the splunk platform to be able to drive that dialog and when that and then in terms of your question.
On who the incumbents are you basically see everybody as we go into these because big companies. So I think global 2000 again, they have a broad range.
But they would term as monitoring solutions.
So you literally see everybody.
Great. Thank you. Your next your next question comes from the line of Brad Sills from Bank of America. Please go ahead. Your line is open.
Wonderful. Thanks, Thanks for taking my question and great to hear the commentary on the interest level is durability, we certainly hear that from the channel would you classify that more as pipeline or deal activity, that's already happening today and if it is more pipeline is there something on the horizon here on the roadmap.
To potentially be a catalyst to convert that pipeline or is this just gradual effort to continue to integrate observer ability with the core security suite.
Yes no.
Great question, Brad So what I would say is just go back to our prepared remarks, we had some amazing wins with our observed ability solution.
In the in the current period at the same time because of the broad interest level pipeline continues to grow as well and so I would say, it's a little bit of both like we've had really good adoption and we're getting good reception. This play are doing tool consolidation has been working well I think that's what's driving pipeline conversion in the <unk>.
Our term and then.
We're on we're on a long journey to continue to deliver new cool capabilities that make the observer ability experience that much better and so I don't know that there's any one thing that anybody's waiting for Brad I feel like the maturity of where we are today versus a year ago was amazing.
And I feel like we've got a really good setup as we head into the second half and into next year.
Great to hear Gerry one more if I may. Please if you could just remind us how the macro has impacted the business or are you talking about elongated sales cycles smaller deal sizes to get deals through and coming out of the macro could we potentially see some acceleration as those things come back.
Yes, so I would say the macro environment has been largely consistent this entire year.
And what that means to us has been we've seen choppiness in cloud migrations, meaning customers. Hermann However, cloud migrations, they will defer them if they can because it represents an incremental project. There continues to be a lot of deal scrutiny, meaning additional sign offs et cetera.
So having said all that as we described earlier I think our team has done a really good job of navigating through that.
So I think we've been able to deal with it reasonably well.
Yeah, and I think in terms of when you think of the second half of the year I have there is no one out there thinking the macro environment is going to get better.
And so I think we have to keep that in mind in terms of how budgets are set for calendar 'twenty. Four so we're not going to provide guidance today for next year, but stay tuned for our investor and analyst day on January nine.
Wonderful thanks, so much.
Your next question comes from the line of pendulum Bora from Jpmorgan. Please go ahead. Your line is open.
Oh, great. Thanks for squeezing me in and congrats on the quarter I just wanted to ask you about the renewals portfolio overall and maybe talk about the performance I think you said renewals rate improved year over year was that for the whole portfolio or just cloud only and any comments on kind of sequential improvement in renewal rates.
Sure. So that renewal is dollar based and it's the full portfolio. So its all and it did increase year over year. So again, we're feeling really good in terms of the value proposition.
Back to Gary's point is how we are executing in this macro environment and this is a year where we.
The renewals should grow in terms of the opportunity roughly 20% this year.
Understood. Thank you.
Your next question comes from the line of Keith Bachman from BMO. Please go ahead. Your line is open.
Hi, many thanks, Gary and Brian I wanted to ask.
About some of the drivers of growth and what specifically one of zero in on net.
Net new logos or net new customers I should say and so we have the metrics for.
Large customers. So I was wondering if you could just if you could speak to the breadth of customers or net new.
Are the net new logos or new customers.
Entirety growing because it seems like if I just take your cloud deepen our which isn't reflected a totally.
But if clouds, even ours in the mid teens and you are guiding to total AAR growing kind of in that same rate.
Could you just speak to the customer breadth underneath the largest customers and the corollary question is if you could speak a little bit to the competitive environment.
Are you seeing more competition.
At some of the smaller customers, whether it be Microsoft or anybody else that you wanted to call out.
Thank you.
Yes, I'm happy I'll take the new customer and then I'll pivot back to Gary to cover the competitive environment I would say I think it's important when you are looking at DB NR for US remember, it's a trailing 12 month base.
12 month metrics. So it's literally the weighted average of the prior 12 months.
The way, we look at it new customers continued to drive growth from an IRR perspective.
New customers generally account for roughly 20% of net new <unk> on a trailing 12 month basis, and we were pleased that in Q2. This metric increased year over year and I'll, let Gary kind of environment.
Yeah on the competitive side I would say the competitive environment is largely consistent with what we've seen this year. The players that we see at an observer ability market will remain consistent and then.
On the security side, I would say consistent as well and even as you go to.
New customers.
We'll see incumbents there you might see some legacy Sim vendor that we then take out and replace.
That's been pretty consistent so I would say there's no there's been no big fundamental change competitively.
Okay, great. Thanks.
Your final question comes from the line of Trevor Walsh from JMP Securities. Please go ahead. Your line is open.
Great. Good afternoon. Thanks for taking my question, Gary maybe for you you mentioned, the FCC, new new regulations around public companies and reporting of incidents.
Imagine Splunk is kind of on the tip of the spear that being assumed in kind of the collector of all the information and alerts coming in how much risk is there.
Within that process, you're probably only going to be as good as the data coming in so how much risk is there around.
The other tools within the security stack, whether it's endpoint network et cetera.
Theyre not properly tuned or maybe not quite best in breed in that that kind of many poor or less less high fidelity data getting pumped in.
<unk> kind of bears the.
The burden of kind of dealing with all of that and maybe the.
Reporting process.
Being maybe not as good as it could be from that perspective, just given that you are kind of the again the spirit of the clearinghouse about the data kind of coming in.
Yes really good question. So I think if you just step back I think the one thing that we're very positive about is this new FCC really really drives organizations to think through what is their strategy. If there is an event at how quickly can they actually understand and then provide.
Broad FCC.
The SEC abroad viewpoint on where they stand so I think that.
Thats the number one thing.
And one of the things we're getting very good at is helping customers mature their security environment. So to your point.
Everyone's violate varies and how how mature they are I think one of the kind of a key really interesting and exciting opportunities for US is we're very much focused on helping our customers drive that maturity journey to get the most value out of splunk and through that they get the visibility they need to make those determinations, because theres lots of <unk>.
This is where as you described that you could have lack of visibility because you didn't get the right data in or you didn't get the right alerts.
We have a very prescriptive program that we're driving with our customers to ensure that they're getting themselves set up correctly and helping them through that journey and that's a very important motion team, we've even accelerated that motion given this new SEC ruling that was something we had in place prior but we're accelerating that.
Great that's super helpful. Thanks, Gary.
And we have no further questions at this time, Gary I will turn the call back over to you great. Thank you I just want to take a moment and thank everyone for joining us on the call. Today, we look forward to seeing you out on the road will be doing a lot of investor relations work over the coming quarter and looking forward to seeing you soon.
This concludes today's conference call. Thank you for your participation and you may now disconnect.
Okay.
Yes.
Okay.
Yes.
Okay.
Mhm.
Okay.
Yes.
Yes.
Okay.
Yes.
Yes.
Yes.
Okay.
Okay.
Okay.
Okay.
Okay.
Mhm.
Okay.
Okay.
Okay.
Hum.
Okay.
Yes.
Yes.
Okay.
Okay.
Okay.
Yes.
Hum.
Yes.
Sure.
Okay.
Yes.
Hum.
Okay.
Okay.
Okay.
Sure.