Splunk Inc.

Splunk Inc.

$156.93
0.17 (0.11%)
London Stock Exchange
USD, US
Software - Services

Splunk Inc. (0R09.L) Q4 2013 Earnings Call Transcript

Published at 2013-02-28 21:30:22
Executives
Ken Tinsley - Former Treasurer and Director of Investor Relations Godfrey R. Sullivan - Chairman, Chief Executive Officer and President David F. Conte - Chief Financial Officer, Principal Accounting Officer and Senior Vice President
Analysts
Philip Winslow - Crédit Suisse AG, Research Division Kash G. Rangan - BofA Merrill Lynch, Research Division Peter L. Goldmacher - Cowen and Company, LLC, Research Division John S. DiFucci - JP Morgan Chase & Co, Research Division Brent Thill - UBS Investment Bank, Research Division Brendan Barnicle - Pacific Crest Securities, Inc., Research Division Adam H. Holt - Morgan Stanley, Research Division Brian John White - Topeka Capital Markets Inc., Research Division Raimo Lenschow - Barclays Capital, Research Division
Operator
Good day, ladies and gentlemen, and welcome to Splunk Fourth Quarter 2012 Financial Results Conference Call. [Operator Instructions] And as a reminder, this call is being recorded. I would now like to introduce your host for today's conference, Ken Tinsley, Corporate Treasurer and Director of Investor Relations. Sir, you may begin.
Ken Tinsley
Great. Thank you, Bethany, and good afternoon. With me on the call today are Splunk's CEO, Godfrey Sullivan; and CFO, Dave Conte. As a reminder, today's conference call is being broadcast live via webcast, and an audio replay of the call will be available on our website. By now, you should have received a copy of our press release, which was distributed this afternoon. If you have not, it is available on the Investor Relations section of our website. Before we begin, I'd like to remind you that during today's call, we will make forward-looking statements, including: Our guidance for fiscal 2014 first quarter and full year; expanded use of our software by our existing customers; the size of our license purchases; our investments in our sales capacity, field operations and vertical markets; and our product enhancements. We caution you that such statements reflect our best judgment based on factors currently known to us and that actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, including the Form 8-K filed with today's press release. Those documents contain important risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. Forward-looking statements during made -- made during today's call are being made as of today. If this call is replayed or reviewed after today, the information presented during the call may not contain current or accurate information. Splunk disclaims any obligation to update or revise any forward-looking statements to reflect events that occur or circumstances that exist after today. We will provide guidance on today's call, but will not provide any further guidance or updates on our performance during the quarter, unless we do so in a public forum. During the call, we will also discuss non-GAAP financial measures. These measures are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of the GAAP and non-GAAP results is provided in today's press release and on the Investor Relations section of our website. The projections regarding our non-GAAP operating margin that we provide today exclude stock-based compensation expense and payroll taxes that are related to employee stock transactions, which cannot be determined at this time and are therefore not reconciled in today's press release. With that, let me turn it over to Godfrey. Godfrey R. Sullivan: Thank you, Ken. Hello, everyone, welcome to the call. Q4 was strong. Revenue for our fiscal fourth quarter was $65.2 million, up 51% compared to Q4 last year. License revenue was $46.8 million, up 43% compared to the same quarter last year. We finished the full fiscal year at $198.9 million, up 64% over last year. We added more than 400 new customers, including DuPont, Poste Italiane, Siemens Energy and University of South Australia and the Department of Homeland Security's Emergency Readiness Team. We now have more than 5,200 customers worldwide, including over 60 of the Fortune 100 and about 200 of the Fortune 500. Eight of the top 10 companies in the Fortune 100 are now Splunk customers. In the past year, we added 11 new customers from the Fortune 100 list, including 5 in Q4 alone, and we added about 30 new customers from the Global 500 last year, 11 of those in Q4. With 400 new customers this quarter, not including Storm, our new customer additions are consistent with last year, and the mix is much more weighted towards global accounts, reflecting strong evidence of where our field investment model is really working. One particular customer win in Q4 that I'd like to call out is an 8-figure, multi-hundred terabytes per day transaction with a technology company. It stands as the single-largest transaction in Splunk history, and it represents the kind of adoption we've discussed before, where we enable our customers to standardize on Splunk. We have a team of people who report to work there every Monday, and we operate as one team. This is a result of a 6-year relationship that grew from departmental to multi-departmental, driving ongoing customer success, and we are now the standard for managing their machine data. Use cases include security, infrastructure, customer authentication, content delivery and overall customer experience. It's all in the logs, and it's all in the teamwork. Another customer that expanded their use of Splunk in Q4 and is standardizing on us is StubHub. StubHub is an online marketplace, owned by eBay, which provide services for buyers and sellers of tickets to sporting events and concerts. In addition to Splunk Enterprise, StubHub also licensed our app for Enterprise Security. We've discussed this theme of customer expansion on prior calls. As more of our customer relationships evolve from departmental use cases into enterprise deployments, we often sell a multiyear ELA, and I'd like to give you some additional color here. For FY '13, we had 25 7-figure transactions, up from 7 -- sorry, up from 11 last year, and some of these are multiyear enterprise agreements. While this isn't a number that we'll report quarterly, it's pretty good color for understanding our progress towards becoming a platform for machine data within our customers. Let's move on to the markets. We continue to drive the majority of our revenue from our core markets: App management, infrastructure and operations and security compliance. Introduction and expansion of Splunk software in these core markets is giving us traction in emerging Splunk markets within our customers, such as web intelligence, business analytics and industrial data. Customers who license Splunk Enterprise for application development and management in Q4 included China Construction Bank, Siemens Energy, the Korea Music Copyright Association and RailCorp. App management remains a core use case where Splunk has strong competitive positioning. Our ability to read complex multiline events from hundreds of source types is something that delights our customers and frustrates the competition. Customers selecting Splunk in Q4 for infrastructure and operations included Comcast, Savvis and Symantec. Customers choosing Splunk in Q4 for security included Sky Italia, Genentech, the EPA and the U.S. Coast Guard. The security market is undergoing a fundamental shift and many of you have read about some of our competitors' challenges in this space. We're seeing 2 major changes. The first is the nature of the threats. The days of a SIM, a rules-based engine built on a relational database, looking for known threats, those days of the SIM are drawing to a close. These old SIMs are not built to handle the advanced persistent threats of today, where the attacks are constant and changing all the time. The second change is that our customers are growing weary of managing these SIMs, which are costly, take a long time to implement and are inflexible to new threat patterns. One of our 7-figure wins in Q4 was in security with a large financial services company. Four companies were involved in the POC, and only Splunk could handle the range of data sources, scale the data to massive volumes, analyze the data in real-time and demonstrate the ability to investigate new conditions. As we take a larger role in the next generation of the security market, we're beefing up our security team. A few days ago, we announced that we've appointed Tim Mather as Vice President of Security Markets and also as our Chief Information Security Officer. Tim has 18 years of experience in senior roles at companies such as RSA, Symantec, VeriSign and Apple. While Splunk is a horizontal technology and used everywhere, Tim's appointment is a good example of where we're organizing and investing in our core market segments. We've also added a number of highly skilled security practitioners worldwide who bring deep operational experience to our team. While I typically report on use cases, like security and infrastructure, as how we segment our core markets, I'd also like to update you on our progress in industry verticals. So briefly, in telecom, 8 of the top 10 telecom service providers in the world are now Splunk customers. Reflecting our continuing international expansion in Q4, we received orders from France Telecom, T-Mobile Poland and Telenor Norway. We also closed an OEM agreement with Velocix, which is an Alcatel-Lucent company and a leader in providing advanced infrastructure solutions for digital content delivery. Velocix will build Splunk Enterprise into their next-generation content delivery solution, and this is because of our ability to perform large data scale ingestion and our ability to drive analytical reporting from their digital content. Our presence among online and brick-and-mortar retailers continues to grow. The top 5 online retailers in the world are now Splunk customers. In Q4, we also signed on GOME Electronic Appliances. They're one of the largest electronic appliance store chains in mainland China. GOME is in the process of increasing their online presence, and they will now rely on Splunk Enterprise to analyze and monitor their core online shopping applications. In financial services, 6 of the top 10 banks in the world are now Splunk customers. In Q4, we received orders from Moody's, Parallax Fund and many others that I can't name, where all of us have our investment accounts and ATM cards. In health care, TriZetto is a new customer to Splunk. As an IT health care solutions provider, TriZetto reaches more than 200,000 care providers and about half of the U.S. insured population. TriZetto's technology execs know Splunk well from their previous company, and therefore, their initial Splunk purchase was a large multi-terabyte deployment. While the decision cycle was pretty short, they didn't need to do a POC. Given their familiarity and prior success with Splunk, their initial deployment will also include Splunk Enterprise, as well as our apps for Active Directory, Exchange, NetApp, Cisco UCS, VMware and DB Connect. We're big fans of the TriZetto exec team, and this win shows how proven success with our customers will drive future success. On to the product report. One of our core product initiatives is to invest in content to support our core Splunk Enterprise platform. During Q4, we released the 2.2 version of the Splunk App for Enterprise Security, with faster performance and higher scalability. The state of Nevada is a new customer to Splunk and purchased Enterprise Security to protect the state's infrastructure from advanced persistent threats. During Q4, we released version 2.0 of our App for VMware, which provides granular visibility into performance metrics, logs, tasks, events and topology from hosts and virtual machines. It provides VMware administrators with a real-time picture of their environment, proactively identifying performance and capacity bottlenecks. The 451 Group wrote that the Splunk App for VMware allows the VMware environment to be managed in the same way Splunk customers are already managing their physical, OS and application tiers. And The 451 Group confirmed what means the most to us, that our customers love the product. For developers in Q4, we announced the general availability of our SDKs for Java and Python. And the Splunk SDK for PHP is now in public preview. We also released the GA version of Splunk DB Connect, which we acquired last fall from a Splunk partner. DB Connect delivers real-time integration between Splunk Enterprise and relational databases, making it easier for customers to use structured business data and enrich it with their Splunk data. As an example, with DB Connect, it's easy to report your top 10 customers who are transacting business in real-time or to compare information that's in a BI report, with real-time trending from clickstreams delivered by Splunk. Now on to cloud and Splunk Storm. We now have more than 160 customers and 200 paid projects on Storm. Some of those projects are from our Enterprise customers, like Electronic Arts, also, hot web companies like Linden Labs. They're using Storm to troubleshoot, analyze and monitor their online virtual worlds, including Second Life and dio. The dio team at Linden Labs uses Splunk Storm to troubleshoot issues in their development, test and production environments. They like Storm because it's easy to get started, easy to manage and scale their data and easy to collaborate among their developers. Wrapping up, I want to thank all of you who attended our SplunkLive! events this last year. We hosted last year 43 events in 16 countries with more than 6,000 customer attendees. And many of you have joined us, and we're really happy to be able to connect our investors to our customers so that you can hear their amazing stories firsthand. In closing, I want to highlight Splunk4Good, which is our social responsibility initiative. We did a few cool things as part of the program this year, including using Splunk software to analyze and visualize the Federal Election Commission finance campaign data. Now this wasn't a typical use case for Splunk, since this was structured data like names, addresses, donation amounts. So why Splunk here? Well, because we have a such flexible indexing engine, a few of our employees, along with some nights of pizza and beer, created one of the most popular websites of the fall campaign. Anyone could look up contributions by names, zip codes, city or party. It just demonstrates the power and flexibility of Splunk, a searchable data warehouse in 3 nights. Splunk4Good also joined the FEMA Innovation Team in the wake of Hurricane Sandy and spoke at the White House earlier this month to demonstrate social media metrics as a result of the impact of the hurricane and the analytical benefits from that data. Before I turn it over to Dave, I also want to say how pleased I am to be ranked #4 by Fast Company in the World's Most Innovative Companies. Fast Company also ranked Splunk #1 among Big Data Innovators, because Splunk democratizes Big Data by bringing the value of that information to everyone. So thanks, again, everyone, for your support of Splunk. And now over to Dave. David F. Conte: All right. Thanks, Godfrey, and good afternoon, everyone. As Godfrey mentioned, Q4 was another record quarter for Splunk and exceeded our plans across the board. Fourth quarter revenue was the highest in our history, totaling $65.2 million, a 51% increase over Q4 of last year. License revenue grew 43% over last year, totaling $46.8 million and was also the highest we've recorded in any quarter. Full year revenue was 64% over the prior year at $198 million. License revenue was $135.9 million, a 54% increase over the prior year. Because Splunk delivers accelerating value as more data is indexed and correlated across an organization, our customers are highly incented to capture more data in a particular use case, then expand from single department to multi-department and then to enterprise-wide deployments over time. To quantify this, we evaluated the buying trends from a sample of our customer base and found that, on average, these customers spent approximately 4x their initial purchase in the 3 years following their original order. Consistent with this sample, Q4 was the fifth consecutive quarter where our existing customers represented more than 70% of the quarter's license bookings. Another milestone we achieved relates to large transactions. In Q4, we recorded 171 orders greater than $100,000, which compares to 94 in Q4 of last year and 125 last quarter. Indicative of how our customers are expanding across the enterprise, it's interesting to note that of the 171 orders, 11 were 7-figure transactions. Now, 7-figure transactions is not a typical metric we'll provide, rather, as Godfrey mentioned earlier, we're sharing it with you so you have some insight on how customers are expanding their use of our software. I've talked before about our focused investments in field expansion and product development, which are reflected in our total revenue results, expanded use of Splunk within an enterprise and the acquisition of new customers. Company-wide, we grew headcount by approximately 250 employees and ended the year with 736 in total. Of these, we added more than 50 in the products organization, ending with 180 total employees working on our platform. In the field, we finished with 163 quota carriers, up from 94 at the beginning of the year. Now recall, it typically takes 9 to 12 months for our field reps to reach full productivity. Of those on board at the end of January, about 50% of them were in this category. Now this is an important modeling item, our time to productivity tends to be longer than what you're used to with other enterprise software companies. From a geographic perspective, I'm pleased with our execution. In Q4, international operations represented approximately 26% of total revenue, with APAC and EMEA posting their best-ever quarters, each growing by more than 60% year-over-year. Our maintenance renewal rate was 92% for the quarter and has been trending upward over the year, reflecting our field coverage and capacity expansion, allowing us to reach more customers in countries where we historically have had limited resources. As a reminder, we calculate our maintenance renewal rate on a rolling 12-month basis. As I've previously described, the mix between term-based and perpetual license sales will fluctuate from quarter-to-quarter, based on our customer buying preferences. Term-based license sales have historically ranged between 10% and 20% of any quarter's license bookings. In Q4, the mix was 13% term compared to 8% in Q4 of last year. On our last call, I said that some of our larger perpetual transactions, or what I'm referring to as enterprise-adoption type arrangements, can contain provisions which require them to be deferred and treated ratably. In Q4, we had a number of these transactions, including the $20 million order, which Godfrey referred to earlier as an 8-figure transaction. When we combine this order with our typical type transactions, we see deferred revenue increase to $115 million at the end of the year, compared to $74 million at the end of Q3. Adoption arrangements typically have longer sales cycles, sometimes spanning several years. As a result, entering any particular quarter, we'll have limited visibility into how many of these types of transactions will close. We expect to see continued variability, not only in the mix of term and perpetual licenses, but also the number and timing of enterprise-adoption arrangements in the future. Our education and professional services are important drivers to accelerate our customers' success and expanded use of our products. Services represented 5% of revenue in Q4, in line with past levels of 5% to 10%. Now as a modeling note, since we recognize our services when they're delivered, they typically do not flow through the balance sheet on the deferred revenue lines. Okay. Unless I otherwise state, our non-GAAP operating metrics exclude noncash stock-based compensation, as well as employer payroll tax expenses related to employee stock plans. So turning to margins and profitability, overall gross margin was 91%, in line with prior quarters, and gross margin on services, which include support, maintenance and professional services, was about 70%. Non-GAAP operating margin was a positive 5% in the fourth quarter, compared to 2% last Q4. For the full year, non-GAAP operating margin was about 1% negative, compared to a negative 4% last year. Non-GAAP net income for the quarter was $3 million or $0.03 per share using a weighted average share count of about 116 million shares in total. Given our full year non-GAAP loss, EPS for fiscal '13 was $0.02 per share and is based on a weighted average share count of about 80 million shares. Remember, the full year count excludes common stock equivalents, given the full year loss. Cash flow from operations in Q4 was $24.8 million. Free cash flow was $21.4 million, and we ended the quarter with over $300 million in total cash. Full year cash flow from operations was more than $46 million in total. DSOs increased to 90 days versus 71 days due to the timing of the $20 million order I mentioned earlier. Excluding that order, DSOs were 62 days, in line with our 60- to 75-day expectation. Looking back over the fiscal year, I'm pleased with our continued field and product investments, our transition to becoming a public company and expansion of our overall global presence, all the while improving our margin profile and generating substantial positive cash flows. Looking forward, we'll continue to invest in product and field expansion in fiscal '14 as we scale the business for our next phase of growth. Our plan is to invest proportionately with our top line. So for the full year, we expect roughly breakeven operations on a non-GAAP basis. We'll achieve these operating results on our expected full year revenue of between $260 million and $270 million. Revenue is likely to follow the seasonal patterns we've seen historically, with between 40% to 45% of total revenue in the first half, and 55% to 60% in the second. With that, we expect Q1 total revenue to be between $52 million and $54 million. License revenue will continue to account for about 2/3 of total revenue for the year and services 1/3. Importantly, services revenue is weighted more heavily in the first half, and license revenue is weighted more heavily in the second. The bulk of our expenses will continue to be headcount-driven, and we expect to add about another 250 people in fiscal '14. We'll add new folks proportionately with our current overall operating expense allocations, roughly 55% to 60% sales and marketing, about 18% to 20% R&D and the remainder COGS and G&A. With overlay with our revenue plan, we expect negative operating margin of between 10% and 12% in Q1, accreting gradually in quarters 2 and 3, then turning positive in Q4, just as we've experienced in fiscal '13 and our prior years. Overall, I am pleased with our Q4 results and our full year performance. Our ability to invest, not only in our infrastructure, but also our field coverage and importantly, our product development, helped us deliver great customer success thus far. We're looking forward to continuing these efforts for fiscal '14 and the years to follow. Thanks so much for your time and interest. With that, let's open it up for questions.
Operator
[Operator Instructions] Our first question comes from the line of Phil Winslow with Credit Suisse. Philip Winslow - Crédit Suisse AG, Research Division: I just wanted to dig into that one metric that you mentioned of just sales into existing customers. I know that was a big focus this fiscal year. Just maybe if you could give us an update on just your go-to-market strategy. I know you've been trying to cross-sell inside those existing customers. Just where do we stand on that as far as the U.S. goes, and you mentioned last call, potentially rolling that out internationally as well. If you could just provide an update on that, too, that'd be great. Godfrey R. Sullivan: Phil, thanks. Godfrey here. It kind of depends on which department we go into first as to how fast we expand. So it's been an interesting learning experience, where when we go in through app -- the app management enterprise applications part of the organization or through infrastructure, it tends to -- those 2 tend to connect pretty quickly, those departments connect quickly. When we go into security, because those folks have really never had a tool that they could share, a technology they could share with other departments, they tend to think more in terms of the silo, and we have to work a little harder to go from that security use case and break into other departments. But we continue to provide our field organization with marketing materials and customer use cases and training and all the rest of that, so that they can use the information, wherever we go in as the first use case to then start spreading the news across the organization. So the large sale that we talked about in Q4 was a perfect example of where -- if you go back far enough in time, we had a one small license in one department and finally a few more in other departments, and it takes time. But we're beginning to see evidence of it across our customer base, and you see a lot of that in the larger transaction. So I'm pretty pleased with the progress there.
Operator
Our next question comes from the line of Kash Rangan with Bank of America Merrill Lynch. Kash G. Rangan - BofA Merrill Lynch, Research Division: Welcome to the mega deal club, guys. That's just nice to see. The $1 billion category, whatever it is. It seems like a day of big deals. Salesforce just reported their numbers, so that call is going to start pretty soon. My question for you guys, the sales force productivity ramp, I think you had talked to it, told us about 50% of your sales force is not yet productive. When you do the cohort analysis, Godfrey and Dave, the people that you hired about a year back or so relative to the ones that you hired 6 months back, 1.5 years back or so, what is the trend in productivity? Are you seeing an improvement in productivity and quicker ability to close $1 million-plus deals? And I have a follow-up question. David F. Conte: Kash, this is Dave. When we look at productivity, it's been pretty consistent in terms of ramp time, and of course, we're talking about averages. But when you look at the expansion into what we call green zones, where we haven't had any coverage, those typically are much longer than if we're adding a person into a previously staffed territory that we may be splitting because there's so much demand and preexisting pipe. So I think we'll look at the overall productivity metrics, and they may start inching forward once we get more critical mass from a geographic perspective. Kash G. Rangan - BofA Merrill Lynch, Research Division: Got it. And also, this $20 million deal that you talked about, I had noticed that your long-term deferred revenue just went up pretty significantly. Dave, any feel for how much of that is actually license? And over what timeframe do you expect to recognize this contract, granted that term licenses seem to be about 13% of your billings overall. I'm not sure how much it was. I think, sequentially, it looks like a higher number. Just wanted to clarify that. David F. Conte: Sure. Thanks for the questions, Kash. Term transactions were 13% for the quarter, and that was up from the prior quarter. But I'm trying to add emphasis that we have other types of transactions that are perpetual in nature. I was calling them early-adoption arrangements, and the $20 million transaction fits that description. Those types of arrangements have a lifespan that is typically 3 years, and that's reflective in the long-term deferred revenue category. So when we talk about our term transactions versus our perpetual transactions that might have characteristics of term, the latter typically have 3 years of duration.
Operator
Our next question comes from the line of Peter Goldmacher with Cowen & Co. Peter L. Goldmacher - Cowen and Company, LLC, Research Division: That $20 million deal is pretty spectacular. One of the big knocks on your business that Wall Street's talking about is how expensive the product is. But if somebody is spending $20 million on your product, they obviously see the ROI well beyond that $20 million. Can you talk a little bit about the justification your larger customers are going through? How they think about ROI? And if I spend $20 million, how much am I saving, not spending, replacing? Godfrey R. Sullivan: Yes, Peter, thanks. Good question. Gosh, one of the most interesting things about Splunk is how many different ways we express ROI, because a customer who takes us in, in the security department is thinking about reputation defense as opposed to somebody in infrastructure who's thinking about better monitoring and understanding their scale out of their infrastructure. So I'll just try to give you a short answer to a really hard and long question. It -- the answer is it depends on who the primary owner is and in what department. If it turns out -- let's take this large customer. In the place that -- we were in, probably 10 different departments, some of which are at massive scale, and we've become so integrated into the company that we're almost like an ERP for all their machine data. We -- every critical system they have is both touching Splunk and ingesting from Splunk. There's 2-way transfer of information. So at some point, if you are that well integrated into the company, you're having less of a conversation about the ROI and more about how do you continue to improve content delivery, customer experience, overall infrastructure performance, security posture. It becomes a multidimensional conversation. And so I think that ROI tends to be a little less of a topic at that level and more about just the criticality of expanding our usage across all those systems. So -- but we have customers who, just for infrastructure, have done case studies. You find them on our website, where they saved $10 million to $15 million a year in capacity planning because they didn't have to forward by hardware if Splunk is able to better monitor the hardware they have and show them peak utilization in places where you buy for continuous monitoring as opposed to peak performance. So ROI comes -- it depends on the economic buyer. It depends on the primary use case. But we feel pretty confident once we're in customers, over a period of time that, that becomes a more of a norm of the conversation as opposed to just driven by a hard ROI conversation. Hope that's some help on your question. Peter L. Goldmacher - Cowen and Company, LLC, Research Division: Yes, that's a lot of help, Godfrey, because what I'm hearing you say is that it's not so much about rip their system out and do it better with Splunk, it's more about there are new opportunities that we see. And it's probably a little bit more challenging for your sales guys, because there's not -- it doesn't sound like they're repeatable use cases, but it's the whole land and expand, where people start with an idea and then over time see the value. So the cost ceases to be an issue when the value is there. Am I paraphrasing what you said properly? Godfrey R. Sullivan: Well, let me -- yes, let me just try it one more time because this is a hard one. But what I would say is it is repeatable, but it's repeatable within the use case. So when we're in an application development or monitoring department, that -- what we're talking to them about is improving your up time up to -- into the high-90s range from whatever it was. We're talking to them about being able to reduce the time to diagnose and fix problems by 90-plus percent. We have very hard ROI metrics for app monitoring. We have very hard metrics for all the infrastructure and operations side around capacity planning and server utilization and hardware costs and all that. We have less hard ROI metrics around threat detection, around advanced persistent threat detection, but nobody else can do what we do. None of the SIMs can handle the kind of data volumes we have. So there's really no -- we're so much cheaper than a SIM and so much easier to deploy and deliver value so much faster that we almost never compete on an ROI except against the cost of the SIMs that customers don't like. So it depends on the department as to what the ROI is, but we have very definitive ROI cases in each of those. When we get to such a large presence in the account that they're buying an enterprise license agreement, it's because all of the departments are saying we want to have a big license of Splunk, and that tends to be a little less of an ROI discussion and more of a standardization discussion. We're talking about establishing Splunk Centers for Excellence. We're talking about how to -- doing data architecture with them, what data is important versus not. We give them much more specific help around how to do large-scale deployments and weaving the departments together. So in the latter cases, it's less about ROI and more about effectiveness. Is that...? Peter L. Goldmacher - Cowen and Company, LLC, Research Division: Got it. Godfrey R. Sullivan: Is that better? Peter L. Goldmacher - Cowen and Company, LLC, Research Division: Yes, very helpful. Godfrey R. Sullivan: They are repeatable. The ROI cases are repeatable at the department level.
Operator
Our next question comes from the line of John DiFucci with JPMorgan. John S. DiFucci - JP Morgan Chase & Co, Research Division: I have a question, I think first question for Godfrey and then a follow-up for Dave. Godfrey, on the multiyear agreements, it's nice to see this commitment by customers, this longer-term commitment. It shows up in the long-term deferred, really strong. Total billings actually accelerated in the quarter from last quarter. Is this something you expect to continue? Do you -- is this like some trend that we -- that you expect in your engagements? I guess the current engagements that you're pursuing right now, do you expect to see more and more of this? Godfrey R. Sullivan: Well, that's what we aspire to do. So there's a part of me that just scratches my head and go, well, Q4 is Q4, and Q1 is Q1, so metrics aren't -- don't always apply. You can't just literally translate Q4 metrics into a Q1. We all start the year over again and start pushing that rock back up the hill. But we're really excited from the standpoint that customers who have had success with us from department to multi-department, there is a place where they come -- the lightbulb goes on and they go, "Wow. This Splunk is not just a department or multi-departmental solution anymore. It actually is the data fabric of all of our machine data and we're connecting it to our structured data, to our data warehouses. We're connecting it to our transactional systems. We're connecting it to the rest of our security systems." It's interesting when they finally get the sort of data platform thing, it's a -- we're having a very different conversation with the customers, and they're coming in and asking us. I was just down in SoCal yesterday having a conversation with a customer and they said, "Can you just come in and do an overall enterprise-wide assessment for us? We have you in 6 different departments. We need for you to come in and just help us understand what's the -- how do we use Splunk at the enterprise level? Like how do we move from multi-departmental to wide-scale use, where everybody's threaded together? And who should run that? And how do you provide user access?" And I mean, it turns into a very different conversation. And that's what we aspire to be as, to be the data platform. We want to be the platform for machine data for all of our customers worldwide. It just takes time, and it takes effort. And it takes driving project success, and we grow up and we get there. So I'm thrilled about the progress we're making, and I hope that what we're showing as evidence here is what we can drive more of in the coming years. David F. Conte: John, let me pile on with just a couple numbers as it relates to is it trend. We, for the first time, we did talk about 7-figure transactions, and of course, we had a record number of 6-figure transactions. That said, our ASPs were about 7% higher, overall, from the fourth quarter of last year to this year. So why is that with so many large transactions? Because the other part of the business that doesn't fit into those categories has been growing significantly as well. So as a percentage of our overall business, we're seeing more of these transactions, but we're just seeing so many more transactions overall, it's reflective in the ASPs. John S. DiFucci - JP Morgan Chase & Co, Research Division: Okay, great. Guys, that's helpful. So hopefully those smaller deals, too, turn into larger deals, as you've talked about in the past, too. But a follow-up, Dave, too, on that one $20 million order, you said it affected DSOs and you see it in the pop in AR, the accounts receivables. I'm just curious, are the payment terms unique for that deal, or will we see that cash collected next quarter? Because cash flow was really strong this quarter, and it sounds like that's going to help in the future, too, that deal anyway. I'm just curious if it'd be mostly next quarter. David F. Conte: Yes, the payment terms were routine, nothing unusual about them. So I would expect to see it in the first quarter. And if you look back over the linearity of our cash flow on a quarterly basis, you'll see Q1 is very often a strong cash flow quarter for us, and Q2 is less than Q1. And it balances out by the time we get to the end of the year.
Operator
Our next question comes from the line of Brent Thill with UBS. Brent Thill - UBS Investment Bank, Research Division: Godfrey, the RSA show, you had a packed booth. And I'm just curious if you could give us a sense of what you're seeing on your security pipeline, and perhaps how that spread is helping you on follow-ons from the security side. I believe last quarter, you said it's about 30% of your deal flow. Any color would be helpful. Godfrey R. Sullivan: Brent, so yes, we had just a phenomenal turnout at RSA. It's a -- the booth was just packed. And if you judge success by how many t-shirts we gave away, it's a pretty positive show. Brent Thill - UBS Investment Bank, Research Division: They were out of the XLs. Godfrey R. Sullivan: I know. I believe it. And the "Take the SH out of IT" is the one that always runs out first. So we're having to modify our inventory mix a little bit. So on the security market, so it still runs typically 25% to 30% of bookings in any given quarter. It's pretty consistent. What's really changing, and you -- if you saw some of those panels and saw some of the press reports out of the RSA show, this was the first year where they're finally calling BS on these SIMs. I mean, they're just basically saying, "Hey, we trumpeted these things for a long time, and now we're seeing customer frustration. We're seeing how these rules engines built on top of relational databases, they take a long time to stand up. They're only designed to deal with known threats that -- because it's an RDB underneath, it can't handle these massive and varying data volumes and the variety of data. You can't change them. They're inflexible." Anyway, we're just -- the customer frustration over these things is finally starting to spill out, and the one company that tends to get some positive mojo out of this whole thing has been Splunk. And not because we're a security expert, but because of the nature of the Splunk technology is such that we can handle all these different data formats. We can give security practitioners an easy user interface to go in and search and look for anomalies, for statistical anomalies, for new threats, different patterns. It's more, these days with APTs, it's more in the math than it is in the rules. And so that's where Splunk is really getting some recognition now. So this was an interesting RSA show for us because it was kind of like Splunk's coming-out party. And I'm not sure we meant it that way as much as the rest of the market kind of had a realization moment and is finally starting to get that there's this sort of old generation and there's the new generation. And Splunk is absolutely in a leading position to define the next generation of the security market, and we plan to do that. We have a responsibility here, and we'll take it.
Operator
Our next question comes from the line of Brendan Barnicle with Pacific Crest Securities. Brendan Barnicle - Pacific Crest Securities, Inc., Research Division: Question, you talked about the security use cases going up to about 25% to 30% of bookings. Can you give us the breakdown on the other use cases, if you saw any change there from what you've seen in the last couple of quarters? Godfrey R. Sullivan: Right. So thanks. It was pretty consistent. So I always think about the whole app monitoring business being about app dev, app monitoring, app management. That whole thing being about 30% infrastructure or operations network, the whole thing. Think the org chart of a VP of IT Ops, everything in that world would be another 30%. What's underneath the CSO would be probably that 25-ish percent, give or take. You get into compliance, it's probably more like a 5%. And then there's a long tail after that, which is business analytics, web intelligence, some industrial data. We saw some interesting new use cases this quarter with industrial data, so all interesting patterns. But the ratios were pretty constant in Q4 with what we saw in earlier quarters in the year. I don't know if there was anything that was a change, and you're talking like a percentage point or 2. We started to see some of these non-IT use cases, like industrial data and web data coming up a little bit. Brendan Barnicle - Pacific Crest Securities, Inc., Research Division: Great. And then in the last couple of quarters, you've talked about the new apps. I think last quarter, you announced, I think, 45 new apps in Q3. Any update on the apps growth? Godfrey R. Sullivan: Gosh, I actually don't remember what the number of new apps is on Splunkbase for Q4, but it's in that range. It was pretty -- and we see, typically, 10 to 15 new apps every month. So it's kind of like in that range, so just a steady set of contributions from the customers. But very encouraged there and love what we see, so it's all good. Brendan Barnicle - Pacific Crest Securities, Inc., Research Division: Great. And then one quick one just for you, Dave. As we think about seeing more deferred revenue, in particular, this long-term deferred revenue, are you starting to think any differently about the visibility you have into the model and into the guidance? David F. Conte: Yes. I mean, we obviously spend a bunch of time on it. But we still have some pretty big variables that are hard to predict, which I had referred to in the prepared remarks around term mix. Has range from 10% to 20%. And when we get into these larger transactions, in particular, we'll see the adoption treatment that translates into ratable recognition. So we consider all that in our model, but they're fairly large contributors on a difficult-to-predict basis. As we start to develop trends that are maybe tighter in terms of percentage of the business or how they're flowing, then we'll certainly update the guidance appropriately.
Operator
Our next question comes from the line of Adam Holt with Morgan Stanley. Adam H. Holt - Morgan Stanley, Research Division: The long-term deferred number was well ahead of our model, more so than just years 2 and 3 for 1 large deal. Is it safe to assume that you had multiple multiyear deals? And are you doing anything in the sales organization to incent those longer-term deals? David F. Conte: Yes, Adam, it's a good question. So you -- we mentioned we had 11 7-figure transactions in the fourth quarter alone. And certainly, more than just the one $20 million deal had multiple years associated to them, which is reflected in the long-term deferred. Interestingly, we haven't been incenting the sales force. The sales force is effectively neutral for the most part between a typical perpetual-type transactions, the term transaction, or ultimately what becomes a multiyear perpetual ratable transaction. So we're spending a lot of time about that. I mean, it -- for us, it's about the customer, like how do we set the customer up for success. We want to reward the guys for delivering on customer success and their sales comp. So that's our motive, and that's how we're going to continue to operate in terms of sales comp. Adam H. Holt - Morgan Stanley, Research Division: Got it. And just quickly on the capacity. You mentioned in your prepared comments that we should be thinking about a longer-term ramp than some companies. Looking at when you added the capacity through the year, it still looks like you should have some upward pressure on the second half of the upcoming year. Is that the right way of thinking about the ramp time and the heads that you've added? David F. Conte: Sure, Adam, thanks, yes. Certainly, if you look at the ramp of additions over the course of fiscal '13, we expect to see contributions from those folks in the second half of '14. Of course, given our particular model, and if you start looking out one quarter, 2 quarter, 3 quarters, what's the mix going to be, whether it be the term deals or the perpetual transactions, so we expect the productivity to kick in at that period of time for sure. And as we get there, we'll guide you guys appropriately.
Operator
Our next question comes from the line of Brian White with Topeka. Brian John White - Topeka Capital Markets Inc., Research Division: Godfrey, just on China, you had a couple of good wins in China with GOME and China Construction. Could you maybe talk about how important China is to Splunk, and what you're seeing there generally? And secondly, Storm, maybe talk about the customer profile and some of the traction you're seeing with Storm. Godfrey R. Sullivan: Great. Thanks for the questions. So on China, I would say -- let me give you a little bit of context on Asia. Over the last couple of years, we were into country expansion mode. And we typically, as we hired a couple extra people out there, we would drop in and open up a new country. And so we did that. In fact, you could think of calendar 2011 as the year we did that. In 2012, we kind of slowed down country expansion and started trying to put people -- more people on the ground in country. So we went from 2 people in Japan to a handful of people in Japan. And that was a really good thing for us, because when you have to serve as many markets as we do, you have the challenge of only one sales person and one SE in a country can't know all the use cases. They can't cover all the customers, on and on. So we try to drop in multiple teams so that we can have some expertise with people from a background of a security market, and the next team will try to have backgrounds from application side or from infrastructure and the like. So we're trying to diversify the backgrounds and skill sets of our people as we go into country. So think about that. And if you were out by yourself in Asia and somebody dropped you into China, you'd just look around and go "Oh my God! What do I do next?" And so we're -- that's kind of where we are in China is we have a -- some -- we have a handful of resources on the ground, nothing to sufficiently cover the market, and they're absolutely in startup mode. So what they are doing right now is working closely to develop a partner channel, and they're opportunistically going after customers who respond to us. There will come a day when we're more -- a more proactive presence there. But I would say, we're absolutely at the starting line in terms of that particular country. It's one of the last that we've been able to get -- to have the maturity of infrastructure to go in. So hopefully, that answers your question. We're just at the starting gate on China. It is important to us, but we will invest prudently there like we did everywhere else. On to Storm, so we had about -- we have about 160 customers now and about 200 projects. And the profile of that -- those customers is very much developers. So when we originally built Storm, our target was developers. And what does everybody do now? They all sort of bypass IT because nobody wants to wait for IT to approve standing up a rack of servers and infrastructure and security and all that stuff, storage. And they just go up to Heroku or they go up to Amazon, and they dial up some capacity, and they start programming. And when their project is done, they either -- it succeeds and they bring it on-prem or they deploy it in the cloud or they shut it off. But they want flexible infrastructure, and that's why that's one of the core use cases of the cloud. So our strategy with Storm was to build the user interfaces and the way it works to specifically go after developers, and we are. And that's who -- typically, their infrastructure is in the cloud. It's typically in Amazon. So because their app that they're developing in their infrastructure is in the cloud, it's really easy just to connect that infrastructure to Storm, and it's working pretty well. I'd say that the one thing that's a little different about Q4 compared to Q3, so Q3 was our first quarter ever with Storm, Q4 was our second quarter live, and the one thing that was kind of interesting was to start to see some of our corporate customers, our Splunk Enterprise customers, like Electronic Arts. They're using us on-prem pretty heavily. And their developers, guess what? They're not on-prem. They went up to Amazon and started a new game and they're developing some apps up on the cloud. So those guys found that Storm was a perfect tool for them because they could turn it on and easily match it to their development environment. So I guess if there was one interesting tidbit about the profile of Storm customers in Q2, it was that we started seeing some of our Enterprise customers' development departments using Storm in addition to them using Enterprise on-prem. So that's good for us, too.
Operator
And we have time for one more question, and that question comes from the line of Raimo Lenschow with Barclays. Raimo Lenschow - Barclays Capital, Research Division: And just talk to a little bit about scaling the business. First, can you talk a little bit of what you're doing on the partner [indiscernible] side, in terms of how they're reacting and if they're going to be any help going forward? And then the other thing is on scaling. If you talk about 250 people getting hired this year, that's about -- that's the same number as last year. But should you not start scaling a bit faster, given that the base case is getting bigger? Godfrey R. Sullivan: Raimo, thanks for the call and thanks for the invitation to your conference last week. Raimo Lenschow - Barclays Capital, Research Division: Great to have you there. Godfrey R. Sullivan: On the scaling piece, it was -- we actually hired more people last year than we had in our plan. And as we kind of go through the year, if we have additional upside in the plan, we hire more people. So part of it is a budgeting exercise, where you try to build your envelope and manage to it responsibly. And if we can hire more people this coming year than what's in our plan, we will. But we won't know that until we execute on a quarter-by-quarter basis. And I have to tell you, the #1 strain in the Splunk organization, going from 250 to -- sorry, going from 450 to 750 in a year is a significant amount of stress on the organization, because of the number of new people that we're trying to train and bring onboard. I'll actually welcome having just a little bit smaller percentage gain in employee base this year, so that the folks who are -- have gone through the ramping over the last year can kind of help us ramp the new people. But that's -- it's still one our biggest organizational challenges, is just bringing people on and teaching them a business that's very different than anything they've done before. Splunk is so different than -- you could have sold or developed or you could've done something else in your life, marketed enterprise software somewhere else and you kind of have to forget most of what you've learned and come in and start all over again with Splunk. So it still is a -- it's still a big resource challenge for us. So, so far, so good. But that's the one place where we try to do it right, the first time anyway. Dave, did you have anything to add to that? David F. Conte: I think that's right. Raimo, there's a -- even with 250 last year, as Godfrey mentioned, we started the year with less than 500. Even looking at 730 when we start this year, adding 250 is a lot of throughput for what is relatively a small company overall. So we really care most about quality versus quantity, and that puts constraints on our hiring capacity. And we're -- we certainly could add more, but we don't want to do so at the expense of making sure we get the best. Godfrey R. Sullivan: The one thing that could crush us would be high turnover. David F. Conte: Yes. Godfrey R. Sullivan: At the rate we're growing, if you factor in a high turnover amount, you just changed all the metrics. Every metric we have goes out the window. So keeping turnover low and keeping quality high is just Job 1 around here. Raimo Lenschow - Barclays Capital, Research Division: On services, did you -- on partners, do you see anything there? That was the other question. Godfrey R. Sullivan: Sorry. Yes, sorry. We continue to see -- the partner percentage of our business continues to creep up by a couple of percentage points every year. And I believe globally, this year, David, it was about 30% of our total revenues went through partners. David F. Conte: Yes, Q4. Godfrey R. Sullivan: In Q4. Sorry, in Q4. 30%, so that's a continuing upward trajectory for us, that to have those numbers. It's much higher than that in international markets and a little lower than that in domestic markets. But all of those numbers are still heading north. So partners are really important part of our business and will be for as far out as I can see.
Operator
That does conclude the question-and-answer session. I'd like to turn the call back to Ken Tinsley for any closing statements.
Ken Tinsley
Great. Bethany, thanks very much for your help. I appreciate it. And thanks for everyone for joining us tonight. I hope you have a good evening. If you have any questions, we're available, reach out to us directly. Thank you.
Operator
Ladies and gentlemen, this does conclude your conference. You all may disconnect, and have a good day.