Splunk Inc.

Splunk Inc.

$156.9
0.39 (0.25%)
NASDAQ Global Select
USD, US
Software - Infrastructure

Splunk Inc. (SPLK) Q1 2014 Earnings Call Transcript

Published at 2013-05-30 23:50:07
Executives
Ken Tinsley - Former Treasurer and Director of Investor Relations Godfrey R. Sullivan - Chairman, Chief Executive Officer and President David F. Conte - Chief Financial Officer, Principal Accounting Officer and Senior Vice President
Analysts
Kash G. Rangan - BofA Merrill Lynch, Research Division John S. DiFucci - JP Morgan Chase & Co, Research Division Daniel H. Ives - FBR Capital Markets & Co., Research Division Brian John White - Topeka Capital Markets Inc., Research Division Brent Thill - UBS Investment Bank, Research Division Raimo Lenschow - Barclays Capital, Research Division Brendan Barnicle - Pacific Crest Securities, Inc., Research Division Sitikantha Panigrahi - Crédit Suisse AG, Research Division Peter L. Goldmacher - Cowen and Company, LLC, Research Division Edward Maguire - Credit Agricole Securities (USA) Inc., Research Division Karl Keirstead - BMO Capital Markets U.S. Sean Hazlett - Morgan Stanley, Research Division Stewart Materne - Evercore Partners Inc., Research Division James N. Gilman - Drexel Hamilton, LLC, Research Division Rakesh Kumar - Susquehanna Financial Group, LLLP, Research Division
Operator
Good day, ladies and gentlemen, and thank you for standing by. And welcome to the Splunk Inc.'s First Quarter 2014 Financial Results Conference Call. [Operator Instructions] As a reminder, today's conference may be recorded. It's now my pleasure to turn the floor over to Ken Tinsley. Sir, the floor is yours.
Ken Tinsley
Great. Thank you, Huey. Appreciate that, and good afternoon, everybody. With me on the call today are Splunk's CEO, Godfrey Sullivan; and CFO, Dave Conte. Just a heads-up, we've had a power disruption to the building today, so if we drop off, we'll dial right back in. As a reminder, today's conference call is being broadcast live via webcast. In addition, the replay of the call will be available on our website following the conclusion of the call. By now, you should have received a copy of our press release, which was distributed this afternoon. If you have not, it is available on the Investor Relations section of our website. I'd like to remind you today that during today's call, we will be making forward-looking statements, including our -- our guidance for our second quarter and full fiscal year 2014; expanded use of our software by our existing customers; the size of license purchases; our investments and product enhancements. We caution you that such statements reflect our best judgment based on factors currently known to us and that actual events or results could differ materially. Please refer to the documents we file from time to time with the SEC, including the 8-K filed with today's press release. Those documents contain important risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements today. Forward-looking statements are made today based on facts known to us. If the call is replayed at a future date, the information presented during this call today may not contain current or accurate information. Splunk disclaims any obligation to update or revise any forward-looking statements to reflect events that occur or circumstances that exist after today. We will provide guidance on today's call, but will not provide any further guidance or updates on our performance during the quarter unless we do so in a public forum. During the call, we will also discuss non-GAAP financial measures. These non-GAAP financial measures are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of the GAAP to non-GAAP results is provided in today's press release and on the Investor Relations sections of our website. The projections regarding our non-GAAP operating margin today that we provide exclude stock-based compensation expense and payroll taxes related to employee stock transactions, which cannot be determined at this time and are, therefore, not reconciled in today's press release. So with that, let me turn it over to Godfrey. Godfrey R. Sullivan: Thank you, Ken. I always hope that, that disclaimer introduction will get better and it just doesn't. Hi, everyone, and welcome to the call. We're off to a strong start in Q1. Revenue for our fiscal first quarter was $57.2 million, up 54% compared to Q1 last year. License revenue was $36.2 million, up 48% compared to Q1 last year. We added more than 350 new customers. New and upgrade customers in Q1 include: The Bank of New York Mellon, Level 3 Communications, the State of Texas Health and Human Services, Nordstrom, the Bank of New Zealand and Winn-Dixie. Thanks to all of our customers around the world for their ongoing encouragement and support. I spent a lot of time on the road in Q1, with trips to APAC, Europe and around the U.S. I probably had 50 individual customer meetings during that period, mostly related to our core markets, but also some interesting activities in the world of mobile and the Internet of Things. The biggest change, a year ago, we were meeting with departmental managers and our champions, this year, most of the meetings are at the CTO, CIO or VP of engineering level as Splunk is expanding from core IT to mission-critical operational analytics. A few examples. In Hong Kong, an online gaming company is using Splunk, not only for core IT use cases of authentication, device behavior and security, but they're also using Splunk to analyze how users are arbitraging their online betting with sub-second trading patterns. Another example, we met in Europe with a C level team of an automatic -- auto manufacturer who is using Splunk to analyze the output of their electric cars. They're already Splunk-ing the cars' charging information and operational health. Their goal now is to provide the driver with interactive information on-screen, so the driver knows where the nearest charging stations are located, and ultimately, to provide an online marketplace where restaurants and movie theaters can promote their destination with a recharge as part of the offering. Another example in Europe, is a wireless telephone carrier that is using Splunk to track their customers via wireless routers. These days, the routers are only 50 to 100 yards apart, so they can see 50,000 customers at a soccer match and then through a time-based geo analysis, understand where those customers went after the game, what towns, what bars, what highways they took. The opportunity is to link companies together with this data to create mobile offerings. Every telco I visited is thinking about how to use their machine data to create a competitive advantage and a better customer experience. Domestically, iRhythm, a medical device company, is using Splunk software to indicate -- index data from their devices to understand how patients use them, to identify potential manufacturing defects and ensure regulatory compliance. McKenney's, a building automation company, is using Splunk to help Eglin Air Force Base take data from 20,000 building sensors to analyze energy usage and reduce energy costs. So while our core business still tends to be related to improving security and performance of applications and IT infrastructure, we see more companies combining that data with mobile data, device data, and structured data to create a better customer experience and a competitive advantage. A few comments about markets. IT operations was yet again above 30% of our total business in Q1. A few of our new customers choosing Splunk for IT ops this quarter included the Arizona DOT, the U.S. Department of Energy, the Ministry of Presidential Affairs in Abu Dhabi, and my alma mater, Baylor University in Texas. Baylor will rely on Splunk for centralized logging, realtime analysis and an understanding of what's happening across their IT systems and infrastructure, and of course, also to proactively identify unknown threats and network anomalies. In a recent report on the IT operations market, Gartner mentioned that "Splunk's value proposition has moved it squarely into this market, resonating with IT managers that are required to turn complex log files, events, metrics and alerts into visualization tools." In the report, Gartner mentioned Splunk as one of the fastest-growing new generation of IT operations management market vendors, referring to Splunk as a platform that is taking market share away from the Big Four. In the security market, we're seeing more validation that traditional SIEMs are no longer adequate for today's cyber security threats. Companies need solutions that are capable of ingesting massive streams of diverse data and performing analytics on that data. Gartner's most recent Magic Quadrant report places Splunk squarely in the leaders' quadrant. That recognition is a clear reflection of the changing requirements of the security market, from static reporting to realtime statistical analysis. Gartner also named Splunk as the fastest-growing security vendor in their 2012 security market share report. In addition, we are proud that the readers of SC Magazine awarded Splunk the Best SIEM solution in the U.S. and the Best Enterprise Security Solution in Europe. Customers selecting Splunk in Q1 for security included the NASA Johnson Space Center, Nomura Securities, Orange France, Arizona State University and NCG Banco. NCG Banco, a European financial institution with 3 million customers in Spain and beyond, significantly expanded their use of Splunk for security. The bank initially selected us as a SIEM to correlate logs from all their perimeter devices. Now Splunk Enterprise is their security intelligence platform for global fraud monitoring. The bank now tracks all money movement, transactions from ATMs, e-banking, branch offices and internal applications, and then correlates and analyzes that movement as a part of their fraud detection system. This quarter, one of our largest orders is a new customer, a large domestic bank. Our champion had come from another large bank, a Splunk customer. He had had a successful relationship with Splunk at his previous company, and therefore, one of the first things he did coming on board was to bring Splunk into his new role. Proven customer success and it drives more customer success. To expand our market coverage, we continue to invest in apps and content. There are now more than 400 apps and add-ons available on Splunkbase. This past quarter, we introduced new versions of the Splunk App for Enterprise Security and an app for Palo Alto Networks. A new partner-developed app is Box for Splunk. This app indexes machine data from Box to track and understand metrics, such as most active users, the most-read files or folders, and other trends based on an organization's usage of Box's service. Another longtime partner, Sideview, is selling an app on Splunkbase for Shoretel that enables users to intuitively browse and report on their call records generated by Shoretel telephone systems. Content like these apps and templates continue to help us close business, such as The Bank of New York Mellon where the Splunk App for Microsoft Exchange was a primary driver for their purchase. For our Hadoop users, we released the latest version of the Splunk App for HadoopOps, which provides realtime end-to-end monitoring, analysis and troubleshooting of Hadoop clusters. We also recently announced partnerships with 2 of the leading Hadoop distributions: Cloudera and Hortonworks. These relationships are driven by our customers' need to use Splunk, to collect, monitor, alert and analyze their machine data, and then in some cases, use Hadoop for low-cost batch storage and additional batch analytics. Now onto the cloud. We now have more than 200 paying customers on Splunk Storm, which represents more than 40% growth over the prior quarter. One notable example of a Storm customer is RevMob, a leading ad network for mobile app developers. RevMob is sending 250 gigs of data Storm from their cloud production environment. RevMob needed a centralized platform for analyzing their machine data, but preferred a service offering to an on-prem solution. We also now see customers using Storm like the SaaS version of our free download. They test their use cases in the cloud and then they go on to purchase Splunk Enterprise for on-prem deployments. An example of this is InstantCab, a company that matches people who need a ride to cabs that are near them. Basically, InstantCab allows you to see the cabs, book a cab, track it on its way to you, and then pay for it automatically through their app. They have over 1,000 drivers in San Francisco and are providing tens of thousands of rides every month. InstantCab started with Splunk Storm in a dev test environment and then moved on with Splunk Enterprise to an enterprise license. While our SaaS business is still in the early innings, we're continuing to invest in building out the team. This past quarter, we brought on 2 highly experienced executives to head our cloud dev and cloud ops teams. We'll continue to invest in a seamless customer experience, which enables customers to use Splunk in whatever way makes most sense for their specific needs, on prem, in the cloud, or in a combination environment. I also want to say it was great to see many of you at our SplunkLive! events recently with over 400 customers each in London and New York City, and more than 750 in Washington, D.C. I really appreciate all of you taking the time to learn about our business and I especially thank our customers for their compelling presentations at these events. Before I turn it over to Dave, I want to extend a warm Splunk welcome to Patty Morrison, who's joined the Splunk Board of Directors. Patty is an Executive Vice President of Customer Care Shared Services and Chief Information Officer for Cardinal Health, and she's a great addition to our board. Thanks, again, and over to Dave. David F. Conte: Thanks, Godfrey, and good afternoon, everyone. Q1 was a solid quarter for Splunk against a difficult macro environment for software, and we're pleased with our results. As Godfrey mentioned, first quarter revenue was $57.2 million, a 54% increase over Q1 of last year. And license revenue grew 48%, totaling $36.2 million for the quarter. These results represent the second-highest quarterly revenue amounts in our history following our recent Q4 performance, and are reflective of the continued value we're providing our customers. In Q1, we added more than 350 new customers, 2 of which were the largest orders closed in the period. Overall, we recorded 132 orders greater than $100,000 compared to 73 in Q1 of last year. Q1 was also one of our largest quarters in terms of the total number of transactions. Overall, ASPs have ranged consistently between $30,000 and $40,000 over the last 3 years, including Q1, as large orders and total order volume have grown proportionately. Collectively, these results reflect the continued momentum we've experienced as more and more enterprises adopt our software and expand its use across their organizations. As Godfrey described, our customers consume Splunk software across a broad set of use cases. Our core market segments of IT operations, applications management and security continue to represent about 90% of our quarterly business, with each trending at about 30% over time. We're seeing this type of use case breadth, not just in the U.S. markets, but globally as well, and the investments we've been making in field coverage are making an impact. In Q1, international operations represented approximately 21% of total revenue, up from 19% last Q1. All 3 geos grew significantly year-over-year, with APAC nearly doubling its contribution and EMEA posting a 74% increase. Importantly, we continue to leverage our expanding partner ecosystem to reach customers in regions where we don't have feet on the ground. In the first quarter, about 35% of our business worldwide involved our partners. On the direct side, we continue to increase our field coverage, and we ended the quarter with 174 quota carriers, up 11 net from Q4, and representing a growth rate consistent with our historic first quarter trends. Outside quota carriers continue to represent about 2/3 of our direct team, and inside, 1/3. Overall, about 50% of our direct quota carrying team has reached full productivity as of the end of Q1. To reiterate, we continue to direct investments into both our own global field coverage, as well as our partner ecosystem, and I'm pleased with how we're performing in these areas. In terms of bookings composition, our mix between term and perpetual license transactions was consistent with our expectations, with term representing 16% of Q1 license bookings. As I've described, we don't differentiate by license type when compensating our field teams. Rather, we look to enable customers to use our software based on their own buying preferences. As such, we expect term license arrangements to continue to fluctuate between 10% and 20% of any quarter's license business. I've described on our last few calls that we also book what I call enterprise adoption arrangements, which can contain provisions which require them to be deferred and treated ratably. These types of transactions are typically larger orders in the 7-figure category and are designed to enable broad adoption of Splunk across an enterprise. We typically see these types of transactions in the second half of the year just as we did in Q4. The level of EAAs recorded in Q1 is consistent with our expectations. Just to reemphasize, we expect to see continued variability, not only in the mix of term and perpetual licenses, but also the number and timing of enterprise adoption arrangements in the future. Our maintenance renewal rate increased to 93% in Q1, our fourth consecutive quarter where renewals exceeded 90%. As I've mentioned, we've built a dedicated renewals team, which now totals 11 of 174 total quota carriers, double the number from last year. Customers also continued to leverage our Professional Services and educational offerings, which together represented 6% of revenue in Q1, in line with our past levels of 5% to 10%. Recall, the following non-GAAP operating metrics exclude noncash stock-based compensation, as well as employer payroll tax expenses related to employee stock plans. Q1 overall non-GAAP gross margin was 90%, in line with prior quarters. And gross margin on services, which include support, maintenance, Professional Services and education was about 70%, also consistent with prior periods. Non-GAAP operating loss was $5.3 million for the quarter or a negative 9.2% of total revenue. Non-GAAP net loss for the quarter was $5.7 million or $0.06 per share using a weighted average share count of approximately 102 million shares. DSOs were within our expectations at 59 days for Q1, while cash flow from operations was $19.9 million, and free cash flow was $18.6 million. We ended the quarter with over $330 million in cash. We'll continue to run the business on a positive operating cash flow basis and expect quarterly cash flows to fluctuate consistent with prior years, with Q1 and Q4 being our largest operating cash flow periods. Also, we expect to increase our capital expenditures over the next 6 to 12 months as we expand our global facilities to support our increasing employee base, as well as expand our cloud infrastructure, consistent with our growing cloud customer base. We expect Q2 total revenue to be between $61 million and $63 million, with license revenue contributing about 2/3 of the total. Going into this year, we had expected between $200 million and $200 million -- $260 million and $270 million in total fiscal 2014 revenue. With our Q1 performance and Q2 outlook, we now expect full year revenue will be between $266 million and $274 million. Consistent with our prior guidance and investment philosophy, we will also continue to invest in field operations and product development at a rapid but controlled pace. When combined with our revenue plan, we expect Q2 non-GAAP operating margin to range between a negative 4% and a negative 6%, accreting gradually in Q3, then turning positive in Q4. We still expect full year non-GAAP operating margin to be roughly breakeven. In addition to the continued field investment I've mentioned, we're also continuing to invest in our products. Our customer success to date has been the result of great products, and we're committed to extending and expanding the way our customers use Splunk, as well as providing them the preferred delivery methods. As Godfrey mentioned, we now have more than 200 customers using our Storm product and we expect to have a greater number of use cases in the future where customers access Splunk in the cloud. We'll update you more as that part of the business continues gaining momentum. Overall, I'm pleased with our Q1 results, appreciate all your time, and now welcome your questions.
Operator
[Operator Instructions] It looks like our first question will come from the line of Kash Rangan with Merrill Lynch. Kash G. Rangan - BofA Merrill Lynch, Research Division: One observation that I had for you, Godfrey, was, I think on the earlier conference call, you said that you intend to finish this year at a 33% growth in sales capacity. When I look at this quarter, you've grown quota carrying sales capacity about a 70% clip, are you reevaluating your earlier decision to slow down sales signing? And is it possible that you might actually move your sales signing targets up in lieu of how you accomplish to end this quarter? And secondly, if you could also talk about what are you doing differently this fiscal year from a go-to-market standpoint, increasing specialization of the sales force, and how are you going to be targeting your ops relief? That will be great. Godfrey R. Sullivan: Hey, Kash, we probably don't expect to change our projected outlook in terms of hiring. It's always better to front-end load the field capacity as opposed to back-end load. We -- the 1 thing we've learned is that it takes folks a full 6 to 12 months, and sometimes longer just to ramp. As Dave said, about half of our sales force we consider ramped at this point in time, so a big challenge for us right now is just training and ramping and getting everyone up to speed, so I think that's probably the biggest issue. We are investing more heavily in the field this year in specialized resources, so it's a very timely question. We have created a security team in the field that has both -- we have a VP in the marketing organization who is our VP of Security Markets plus our CSO, as well as a dedicated set of security leaders in the field because that portion of the business requires specialized expertise. I can see us mimicking that model in other market segments as time goes on. It's just -- it's a requirement to map up to the domain expertise in those markets.
Operator
Our next question will come from the line of John DiFucci with JPMorgan. John S. DiFucci - JP Morgan Chase & Co, Research Division: Dave, you said that it was a difficult macro environment, and it certainly was. We saw a lot of companies put up numbers that were -- reflected that, and Q1 definitely was tough for everybody, but your quarter here looks good. But there's one thing here, the billings were a bit below what we were looking for. I just -- was there any areas, both Godfrey and David, that you -- that were more challenging in the quarter than you thought they might have been? And I guess, Dave, was there any foreign-exchange impact on deferred revenue? Because the deferred was a little lower than what we thought it would be. David F. Conte: Yes. John, in terms of geo pressure, and you're right, and I mentioned it in the -- in my prepared statements. The software sector, overall, I think had a challenging period and not so much for us. We were pretty consistently strong across the 3 major geos. If there was 1 area where the predictability and the uncertainty is certainly still present, it's in the public sector, and particular, the federal government. But overall, we saw strength across the board. John S. DiFucci - JP Morgan Chase & Co, Research Division: Okay, great. And was there any foreign-exchange impact on deferred revenue? David F. Conte: No. Our foreign-exchange amounts, I think, for the quarter is less than... John S. DiFucci - JP Morgan Chase & Co, Research Division: Pretty small? David F. Conte: Yes, it was less than $100,000, which you can see in the other income/expense category. That combined, with our international tax, you can see it below the operating margin line. So it was pretty small. Deferred revenue for the quarter grew year-over -- from Q4 sequentially even though we obviously came in on top of our prior guidance. John S. DiFucci - JP Morgan Chase & Co, Research Division: Yes. And if I could, just 1 more. Dave, you mentioned the maintenance renewal rates, 93%, that's actually great to hear. And you mentioned 11 people on your renewals team. I guess, are the other field reps still getting paid on renewals, any commissions on the renewals or have you transferred this entirely to renewals team? David F. Conte: I would say it is -- the majority now transferred, John. There are pockets in -- across the globe where we don't have dedicated resources, that we still ask our direct field team to carry the burden for renewals. But a majority of the field is now segregated between new business, license and first-year maintenance, versus maintenance renewals. John S. DiFucci - JP Morgan Chase & Co, Research Division: Okay, great and -- okay, that's a bit... David F. Conte: John, by the way, I knew you would like that. John S. DiFucci - JP Morgan Chase & Co, Research Division: It's great to hear. And it's nice to see some results -- especially relative to what everybody else has done.
Operator
Our next question will come from the line of Daniel Ives with FBR. Daniel H. Ives - FBR Capital Markets & Co., Research Division: My question is, can you just talk about any anecdotally changes that you're seeing with customers in terms of your solution and just the more adoption rates that you're seeing throughout our verticals? Godfrey R. Sullivan: Probably, the single call out for Q1 was this kind of sea change in the security market. So we had a strong quarter in the security market. It's -- I have to call that market a solution. When customers are attempting to improve their security posture or defend themselves against advanced persistent threats, they fully understand now that the old-fashioned SIEMs that were kind of a rules engine built on RDB are simply not sufficient against -- defending against these ongoing attacks. I had a CIO in our office a couple -- a few weeks back -- major -- a $35 billion company describing to me that basically what was -- what you read in the Mandiant report, and it will scare you to hear what's really going on. And they need and have a full-time team of a half a dozen people, that are sitting there watching full-time attacks on their systems, and they're using Splunk to spot those anomalies. These are very clever people. And so we're just seeing that the security market is really moving off of sort of yesterday's model of a rules engine to a model where you have to have the ability to do sophisticated statistics on large data sets. And so when you see us moved into the leaders' quadrant for Gartner, you see us getting product awards by SC Magazine, you see Gartner describing us as the fastest-growing security vendor, et cetera, it is the same set of products we've had in the market for several years, it's Splunk Enterprise plus our security app. But the market's coming to us because of the need to be able to do free-form analysis against large data sets. So that's just 1 example. You see I could give you example after example, sort of market-by-market, but I think the security one is a good call out just because it's been such a noticeable change and you see it in the conferences, you see it in the press, you see it from the customers.
Operator
Our next question will come from Brian White with Topeka. Brian John White - Topeka Capital Markets Inc., Research Division: Godfrey, could you talk a little bit about DB Connect? You announced it, I guess, back in -- or released it back in March, maybe walk through the reception so far? And what are you trying to accomplish here in the database market? And is it opening up new growth opportunities for Splunk? Godfrey R. Sullivan: Thanks for asking that question. I had a paragraph in the script and I took it out because my script was getting too long. But now, you just gave me the chance to talk about it. So we went GA with the DB Connect app during Q1. In a very short period of time, it has had more than 5,000 downloads off of Splunkbase. Our customers love it and they're now sort of using it to combine streaming event data with data that's held in a warehouse or a relational table somewhere, or an Excel spreadsheet for that matter. So you see customers doing things like combining their -- matching up IP addresses and host IDs that are coming into their website, from who's downloading their content -- their white papers, for example -- and map that over to their sales force environment and know which customers of their top customers are visiting their site. We see customers looking at online -- everybody with online web -- customer-facing websites. Anybody who is selling or high transaction in volume on a .com environment, you want to be able to take those logs and correlate them against a relational database or a warehouse to know which customers are they, what products are they looking at, multiply a product times a price and get realtime revenue on your website. It's all in the logs, but the ability of DB Connect to connect that realtime streaming activity back to customers, products, SKUs and prices, is just a compelling event. So it's like gone from GA to the most popular download just in a matter of 30 days.
Operator
Next questioner comes from the line of Brent Thill with UBS. Brent Thill - UBS Investment Bank, Research Division: Godfrey, even the software companies that have done well in Q1 have said it's taken about 10% more perspiration to get these deals done, and clearly, your results have been really good relative to what we've seen as highlighted by some of my colleagues earlier. But I'm just curious if you feel like kind of -- when you dig down 1 layer deeper, has the environment changed at all or are you just in such a unique position with the product and the pipeline that you're kind of cutting through this headwind, if you will? Godfrey R. Sullivan: Yes, thanks, Brent. Well, I mean, it's nice to have such a highly differentiated product like Splunk. You feel grateful for it. But the downside of that is that we have different competitors in every market segment. So the guys we run into at app management are different than the ops guys, different than the security guys, different from the web intelligence guys, on and on. And so we see plenty of competition in the marketplace. And I would agree with the other execs who have said there was 10% more perspiration involved in bringing the business across the line. It's just -- you have to go fight for the budget. And any time budgets are tight in the macroeconomic environment is what it is. CapEx gets constrained, OpEx gets constrained, and you're just fighting against everybody not because you have a necessarily competitive product but you -- because you're fighting for scarce budget dollars. So no, I would acknowledge that there was more perspiration involved, and I think -- Brother Schroeder [ph] would agree with that. Brent Thill - UBS Investment Bank, Research Division: Okay. And Dave, just a quick follow-up on the quota carrying growth last year was over 70%, did you update the kind of growth rates you're thinking about for '14? And also just the big deal flow, you had a big deal in Q4, did you see any of those type of elephant contracts in Q1? David F. Conte: Yes -- no, we did not have any $20 million transactions in the first quarter like we did in Q4. We did have 132 transactions greater than $100,000 which is our cut-off point for the definition of large, so we're definitely seeing more volume in larger transactions. And I think it's commensurate with Godfrey's earlier point that, what's different from a year ago is the level that we're having discussions at our customers and prospects has really elevated to the C level, the DP level, and as you'd expect, they have a broader set of use cases that they look to deploy our product around. In terms of what we're expecting, in terms of sales force expansion and capacity, we haven't specifically quantified quota carriers for fiscal '14. But you can expect that our headcount growth will be consistent in terms of absolute numbers with the prior year and will follow the line items of the P&L, so you'll see a 50% to 60% of our revenue invested in sales and marketing, and the headcount will follow in that regard.
Operator
Our next questioner in queue will come from the line of Raimo Lenschow with Barclays. Raimo Lenschow - Barclays Capital, Research Division: Two quick questions. The first one is going back to Brent's question, I just jumped off the Palo Alto call, and we have a big debate at the moment -- did April got worse than March? And maybe you can -- I know you didn't see it and you still executed well, but maybe any comments there in terms of how the linearity in the quarter played out? And then a question I asked a couple of quarters ago, and that's kind of the dynamic between larger clients and deciding about ELA versus volume pricing and -- any update on that one? Godfrey R. Sullivan: Sure. Well, since our fiscal period is April 30 and not March 30 -- I know Palo Alto is on the same as us, but Q1 is always more back-end loaded than other quarters because sales compensation plans for enterprise software are what they are, everybody drags every possible order across the line at the end of Q4, and if there's ever a time in the software business where the cupboards are bare and you have to rebuild the pipeline, it's Q1. And so it's not all that surprising that you see some softness from companies this quarter. So that part of it -- I don't know, it's just Q1 is Q1 in software. What was the second part of the question, because I barely hear you. Raimo Lenschow - Barclays Capital, Research Division: Linearity and volume pricing. Godfrey R. Sullivan: So ELAs and volume pricing. So even though Q1 is Q1, we did, in fact, have some 7-figure transactions that were enterprise agreements and get treated deferred over time type transactions. So yes, there's still momentum in the business at the high-end and we're making really good progress in terms of the conversations with customers around arrangements with Splunk to give them lots of capacity to try new things and deploy in lots of new places. So I'm very encouraged by the pace of those conversations and the level at which we're having them.
Operator
Our next question will come from Brendan Barnicle with Pacific Crest Securities. Brendan Barnicle - Pacific Crest Securities, Inc., Research Division: Dave, I want to follow up on a couple of metrics, I think, you gave us in the Q&A on the last call. One was percentage of revenue from existing customers and then of that, that breakdown from expansions and upgrades. And then also, last quarter, you gave us this metric of around original purchase size over a 3-year period, you said that it had been up 4x, so those -- are those trends all remaining the same? David F. Conte: Hey, Brendan, so the trend around how large the purchase size is or how many dollars they bring, or a customer represents after their initial purchase, I'd have to refer back to our prior commentary. Like, we haven't updated that analysis. At that time, when we were going through the Q&A, our analysis showed that customers spend somewhere between 4.5x and 5x the amount with Splunk in the 3 years following their initial purchase. So that, again, we'll update that probably on an annual basis because we like looking at the same customer base, the same sample size to see what those trends are. As it relates to upsell versus new, versus upgrade and expansion, this quarter, it -- I had mentioned our 2 largest transactions were new customers, so our new customer percentage actually was higher than it had been in prior quarters. That said, upsell still represent over 50% of the business for Q1. That mix is still probably 2/3 expansion in terms of new use cases and 1/3 in terms of upgraded capacity. Brendan Barnicle - Pacific Crest Securities, Inc., Research Division: Great. And then just one for Godfrey, great momentum you guys are having on the app side now that you're over 400. Are you seeing more acceleration? I mean it may play off some of the earlier commentary you had around kind of increasing adoption you're seeing in the security vertical, are you just seeing sort of a standardization where it's an inflection point or is this just sort of more of the same? Godfrey R. Sullivan: Well, I didn't see anything that was so different in Q1 that it's worth a call-out to your question with a specific answer. But I would like to just touch on this whole notion of apps and content up on Splunkbase. The one -- one of our partners that I mentioned, Sideview, this is one of the first examples of where one of our partners is actually selling an app on Splunkbase, so I really view this whole notion of content on top of the Splunk platform as a place that will ultimately drive an enormous amount of traction and further enterprise adoption. That, to me, is really exciting. They're actually using the same kind sort of a free trial that we use with our download where you could try the product for an x amount of time, and then buy it for -- I think it's $2,500 for a 2-year subscription. And it's a good example where we want to encourage an ecosystem to build content on top of the Splunk engine and we want them to be financially successful off of it. So just like we have a couple of pieces of content that we charge for, which is our Enterprise Security and PCI solutions. Over time, as things grow up from sort of a template to a full-scale app with product life cycle management and documentation and support and all that stuff, we'll see additional pieces of content that move from free into paid. So I think this sort of notion of more and more content and more valuable content, more fully developed and baked content is going to help us become a standard across enterprises as they realize that the indexing engine itself is a data platform and you can get enormous value in multiple departments. So I'll try to give you more color on that on the next call, but I didn't see it -- I don't have a specific story from Q1 about that other than just sort of general momentum.
Operator
Our next question will be Phil Winslow with Credit Suisse. Sitikantha Panigrahi - Crédit Suisse AG, Research Division: This is Siti Panigrahi for Phil Winslow. I was just wondering if you could talk about competitive landscape and also dig a little bit more into your cross-sell opportunity in the U.S., as well as your strategy to expand into international markets. Godfrey R. Sullivan: Well, competitive landscape discussion can be quite lengthy because we have competitors in so many segments. So I'll try to oversimplify that and say in the security landscape, in security market, the landscape did not change much. Most of the places where we complement is when customers put us in next to a SIEM, there are other places where they're actually using Splunk to replace the SIEM or they're buying Splunk and never buying a SIEM, so that's probably the place where the most noticeable shift is underway. In the whole area of infrastructure, it was business as usual. There was nothing -- the competitors are all still the same, there was nothing much that changed there. Not too much in the app management space, but there was a fun call out. It was when we did our -- for those of you who had a chance to attend our SplunkLive! in Washington, D.C. at the Reagan Center, where it was packed house, 750 people, you also saw for the first time, we had about 10 partner exhibitors there showing the solutions that they're building on top of Splunk and most of those were in the app management or infrastructure use cases. So I actually think we're kind of gaining some traction there in terms of building an ecosystem around us in that category. And then the other place where it was just -- the most noticeable change for me personally in the quarter was the number of conversations that I had, a lot of it was in the script. The number of conversations I had in the quarter with executives about non-IT use cases where they're combining non -- IT data that we already have in Splunk with device generator or mobile-generated data that has to do with their customer analytics or business analytics. To me, that's the one that's just really a change from a year ago, and that's not so much competitive dynamic as it is a new set of use cases coming up. They might have used -- in the past, that might have been a -- it sounded an awful lot like the old BI conversations that I used to have in my Hyperion days, where they're really asking questions around changes in customer behavior, product velocity, all that sort of thing. But now, the product velocity and the customer behavior is coming from mobile devices, it's coming from websites, it's coming from streaming events information and so they're asking what you think would sound like BI question, but it's actually operational analytics off of machine data.
Operator
Our next question will come from Peter Goldmacher with Cowen and Company. Peter L. Goldmacher - Cowen and Company, LLC, Research Division: Godfrey, I want to talk about your last comment because this is the first call you got -- you posted where I think the majority of your use cases were beyond the traditional IT operations use case. It seems to me, as you move out beyond IT operations, your total addressable market expands pretty dramatically and that presents its own unique challenges as perhaps you need to reorient the sales force to go after vertical opportunities and go after specific industries. So what -- I'd like to hear a couple of things. One is, of your nontraditional IT use cases, are they coming from customers that already exist using your product in IT operations, they gain familiarity and then they see opportunities beyond IT? Or is it a whole new category of customer that their first-time use is something non-IT and as you build out your 3-year plan, how do you intend to approach that opportunity? And my bonus question is, how are you going to think about the business on-premise versus on-demand as you grow into the future? Godfrey R. Sullivan: Okay. Gosh, I'm going to probably take a subset swing at that with an example and see how many of those questions I can click off with an example. So when I was in Europe, I met with probably -- in a span of a 2-week travel period, I probably met with 4 or 5 major telco customers. And the conversations sounded like, "Splunk, we love you guys for IT operations. We've had good success with you. We have you in 3 or 4 different departments. We're up to 1 terabyte or 2 or some number like that, but we now see that we need to use you on a larger scale because we really need to analyze all the mobile data in order to understand customer analytics, changes over time, all that stuff. Oh, by the way, because these data volumes are so large, we've been throwing a lot of that stuff in Hadoop. And the only problem is, we can't get it back very easily and so..." I actually had 1 large telco on the continent call Hadoop their data grave, and that's not meant to be a belittling remark but rather they understand that it's kind of like cold data, that's where you send data to rest. And now they know they need analytical tools on top of it so that they can get realtime analytics from both the real-time streaming data off of their systems, as well as data that's at rest or somewhere staged. And so they were asking us a very different set of questions. It wasn't a conversation around, how does Splunk compare to some competitor in IT ops? The question was, Splunk, how do you see yourselves as a core part of our enterprise software architecture, and what role do you play compared to the visualization guys, the Open Source batch storage guys, the OLTP transaction engine, how and where do you fit in that world? Now, to your question -- so to your question now about all these different use cases is when you get out into that world of industrial data, more and more, that's the question they have. That sort of where does Splunk fit in my enterprise software architecture, because I have lots of other tools that I have applied against these use cases often without very much success. They have the same headaches that the BI vendors used to have in terms of aggregating lots of data and it takes years before you ever get any analytics out of it. So I see this as a very interesting time for us as we move from being an IT search vendor to operational intelligence. And the category we've been trying to define and create is actually starting to emerge, more and more people are writing about it, we're being invited into C-level conversations and the like. So it poses challenges for us because the use cases tend to be very different just like the operational side of BI has a lot of diversity to it. Our -- what we have to do there is to do a really good job of explaining where is Splunk a fit and where is it not a fit, and I think we're getting better at that, we're seeing it because of all these diverse use cases. And then, you can apply that to, well, how do they want it delivered? The delivery is in these cases a secondary or tertiary concern, they're more concerned about solving the problem. And so that's that. So let me pause there and say, did I get some of it or all of it or is there anything you want further discussion around? Peter L. Goldmacher - Cowen and Company, LLC, Research Division: No, that's a great answer, a really good story. One of the things I think about is the utility, part of the value of what you guys are able to do with Storm is just create an enormous body of data. And so there is typically a challenge for a company going from a traditional perpetual on-premise license to a software service delivery model with subscription, but the benefits, there's real upside because of the data you get to work with. And what I'm -- what I was trying to get a sense of is, how are you thinking about that transition? And what I heard you say was, right now, we're letting our customers decide and there is no Splunk preferred method, and I suppose that works for now, but I -- am I right to suspect that at some point down the line, you're going to get a little more disciplined internally on on-premise versus a Software-as-a-Service model? Godfrey R. Sullivan: Okay. So let me take on sort of cloud then, as a specific topic, as opposed to sort of operational analytics and how that -- and all the different ways that gets done. So if I had to give sort of an observation on that, it would be that the questions customers are -- when a customer asks us to deliver them a service, they rarely say, "Splunk, I'd like for you just to do generic logging for me in the cloud." That's rarely how the conversation goes. They say something that sounds much more like a solution. And especially, when you get to a CIO level. They say, I'd like to have a security service where you're able to take data and the learnings from it and help me have a better security posture because of your learnings, what you get from looking across large data sets and working with lots of customers. And so that's a good example where I -- I really believe that this -- 3 years from now, we'll be talking about the cloud as a series of solutions delivered as opposed to -- as my -- we spent a lot of time today talking about Splunk as an analytical engine, in the cloud, we'll be talking a lot more about solutions delivered. So for example, we have 20 MSPs worldwide right now that are using Splunk as the engine to delivered -- to deliver managed services for security, including having signed up NTT in Japan in Q1. So we will have -- there are multiple ways to use a logging engine, an analytical engine like Splunk to deliver a SaaS-based, a service-based, if you will, solution for customers. I've had customer say the same thing about PCI, about customer analytics, about this, but they never say, "Oh, I'd just like to move my logging to the cloud." What they say is, "I'd like to get a solution to this problem, and can you deliver it as a service?" So the hard answer to your question is, we have to, over the next few years as we evolve Storm and we evolve its architecture and we evolve its content and whatever else, is to determine which solutions do you want to deliver to customers, so that you can do the same thing a thousand times, as opposed to one thing -- a thousand things one time you want to do -- you know what I mean. You've got to have a repeatable notion [ph] if you're going to offer a cloud service and I think that will look more like a solution and/or series of solutions delivered off of somewhat more predictable data sets. When a Barclays presents in London and says, "We're using multiple terabytes of Splunk data per day and we're feeding 430 data sources into it and we're doing enterprise-level, et cetera," that's a pretty hard model to replicate in the cloud. So that's why I think you'll see smaller numbers of data sets, more focused types of feedback and reports back off of it, so let me stop there. Peter L. Goldmacher - Cowen and Company, LLC, Research Division: Yes -- no, so more of an application approach through Storm and more of an infrastructure approach through the on-premise stuff? Godfrey R. Sullivan: There you go. I wish I had said that up front. It'd have saved me a lot of time.
Operator
Next question comes from Ed Maguire with CLSA. Edward Maguire - Credit Agricole Securities (USA) Inc., Research Division: I'd like to just back up. Godfrey, last quarter, you had thrown the gauntlet down and said that on the security segment, you guys were -- you were starting to really take a lot of business away from point solutions. And I was wondering if you were seeing a similar trend play out in your other IT, either in the application performance management or some of the web analytics side? Godfrey R. Sullivan: Well, yes. So hi, Ed, thanks for the question. And I guess, it has played out to a degree in Q1 on the security side as you've seen the number of awards we've gotten and market share reports and all that. So I think we were justified in our commentary on that one. On the other segments, I don't have a story or a proof point or a claim to make that there is some huge shift going on other than the shift that's been going on really for the last 5 years, which is the move from point solutions. I've got my network monitoring tool, I've got my database monitoring tool, I've got all those point tools. But I still can't find where the breakdown was or where the transaction failed. So I would say it's business as usual in app management and IT operations, where customers are finding that being able to put all the data in 1 place, that place being Splunk Enterprise, is the new wave. It's still certainly working in our favor. Edward Maguire - Credit Agricole Securities (USA) Inc., Research Division: Great. And just one follow-up which is that, if I look at the targets that you've laid out for this year, I mean, you've got hiring, it seems to be running maybe ahead of pace, what if any constraints or gating factors do you see in scaling -- continuing to scale the business whether it's just operational or do you have the condition of the macro markets or just the pace or the ability of your customers and partners to digest and implement the software? Godfrey R. Sullivan: It's the latter. It just takes time. It's the old mythical man month in software development. You can apply 9 people to the baby, but that doesn't mean you'll have it in 1 month. So it's just a matter of -- it takes time to hire people, onboard them, get them productive, have them all working in harmony and paying close attention to customer requirements and being responsive, you have to be agile but you have to stay focused. So, no, I think it's -- the hardest part of our business when you're growing at our rate is trying to onboard both people, partners, software developers and so forth and keep moving at pace.
Operator
Our next question will come from Karl Keirstead with BMO Capital Markets. Karl Keirstead - BMO Capital Markets U.S.: David, I'm just thinking through how this mix shift to enterprise adoption arrangements, as you call them, affect the financials. One obvious way is that your long-term DR got an uptick in 4Q. But I'm just thinking of other stuff. For instance, is there a portion, maybe you can remind us, of these arrangements that are not yet billed, that would create an unbilled backlog, and if so, if you could help size it? And if there's any other P&L or cash flow impacts of these arrangements that are worth calling out? David F. Conte: Sure. Hey, thanks for the question. On a very infrequent basis, we might have a contract that has an extended billing cycle where we might bill annually or even quarterly. But those are very infrequent and de minimis overall. Obviously, when you look at the geography between deferred revenue and revenue, you'll see it can fluctuate any quarter depending on the types of term mix that we'll see, as well as the impact of these enterprise adoption arrangements. So in terms of any other elements on the balance sheet, the income statement from those, it's really that geographic mix, and there is, again, very little that isn't billed at this point.
Operator
Our next question will come from Keith Weiss with Morgan Stanley. Sean Hazlett - Morgan Stanley, Research Division: This is Sean Hazlett filling in for Keith. So I wanted to go back, Godfrey, and revisit kind of the topic of monetizing apps, and it sounds like you've introduced a number of apps this past quarter and you are kind of charging for some of them. How do you kind of see that going forward? So for instance, how do you decide when to start charging, and how do you monitor usage for apps that you haven't charged for yet? Godfrey R. Sullivan: Yes. So thanks. We actually, internally -- externally, we overused the term apps because it's easiest to describe content in that way. Internally, we actually have 3 tiers. We have apps, a real app; we have templates and we have add-ons which are almost like connectors or do something much more specific. We don't generally think about charging for templates now or probably ever because they're pretty thin where it's like a macro for Excel where you get a template that you would drop on top of Excel and it helps you do income statements, but you wouldn't think about buying it. It's very helpful, but probably not chargeable. When templates go to full product life cycle management, where we have MRDs and PRDs and dev teams working on it and we've probably put workflow into it, in fact, we have put workflow into it, and it's very specific around its functionality in order to meet some customer requirements, that's when it goes from a template to an app, and that's when we start charging for it because it's something that we have to maintain and continue to develop over time. So enterprise security and PCI are good examples of things that started as templates, morphed into apps over time, and now we -- they are significant in terms of their functionality in workflow, and we charge for them. I can see some of our templates that are currently free, ultimately, going to paid as they grow and mature. So I could see a day when, for example, our Microsoft Exchange, our Active Directory, the Windows stuff like all -- put all the Windows stuff into 1 environment, put a user interface on it, put workflow and notifications into it, put enough functionality into it where a customer feels like paying for it is a good value, I could see that kind of evolution. I could see these things in IT operations where you're combining multiple templates and having a more consolidated view. So we have work like that, that's always under consideration, I'm not ready to announce anything. And right now, we're just trying to make sure we understand customers' needs and keep moving towards that. But yes, you'll see -- I wouldn't be surprised if next year, that we have more content that has a price tag on it. Sean Hazlett - Morgan Stanley, Research Division: Okay. And then I have a quick second question. In terms of the sales force ramping, you said, you're much [ph] now about 50% ramped, it takes about 6 to 12 months for the average salesperson to ramp up. How does that look internationally? So is that breakdown as high and also, is it still kind of the same kind of 6- to 12-month time line? Godfrey R. Sullivan: Yes. I spent a lot of time overseas and I don't see a significant difference between domestic and international in terms of ramping. If anything, the domestic guys have a little bit of an advantage because they have more help nearby where the international guys are oftentimes lonely and far from somewhere. So I would say that the domestic guys have a little bit of an advantage on them.
Operator
Next question comes from Kirk Materne with Evercore Partners. Stewart Materne - Evercore Partners Inc., Research Division: Godfrey, as you guys get into more, I guess, complex discussions with partners looking to build sort of new and different apps on top of your platform, I guess, how do you think about sort of building up a professional services organization or partnering with more smaller SIs or bigger SIs to make sure that there's the technology, I guess capabilities in the market to allow them to really experiment with your platform that's so open-ended in so many ways. I guess, what's sort of your thought process on that? I'm particularly interested in sort of your thoughts about bringing on more small system integrators into the ecosystem? Godfrey R. Sullivan: Okay. Well, what's so -- I forget what we have right now, but I think worldwide, we might have 15 people in Professional Services, it's a small team, mostly formed up to help our partners ramp, as well as take care of core customers that just want professional services from us. They want our skin in the game. I really look at our partners today and it's kind of a tiering model. It was very difficult for us to build up an integrator ecosystem in the early days because Splunk is so easy to deploy, and the time to deploy is so short that there hasn't been much of an economic model for partners. Most of our customers that are in the 1 to 20, even up to 50-gigs-a-day size, they deploy in 24 to 48 hours, so there's no business proposition for a partner to go in there and sell services. It's only when you get to a larger installation with a customer, where Splunk has become the data platform, and now we're talking about data architecture and efficiency and servers and storage and fail-over and all that stuff, all of a sudden, the business is complex enough that the integrators start to get interested. So now, we have multiple integrators who have approached us, we have approached them, and we're sort of working on accounts together, and I think it's looking pretty good. As Dave said, we had something like 35% of our business go through partners in Q1, so it was a healthy piece of business for them and for us. So I think it's -- as we expand from really easy-to-use, quick-to-deploy departmental tool to large-scale enterprise vendor, that really offers them a consultation opportunity that they didn't have a few years ago. So I would just say stay tuned on that, I'll try to give you a little bit more -- maybe on the next call, we'll give a little bit more color around some of our partner activities. Making really good progress there, it's the big standardization actions in customers that really drive that opportunity for them.
Operator
Next question comes from James Gilman with Drexel Hamilton. James N. Gilman - Drexel Hamilton, LLC, Research Division: Godfrey, I just want to -- you mentioned earlier in the call your discussions with your customers are going to, how we use on a much larger scale, and I was wondering, has the discussion around maybe pricing changed a little bit how you might price the solution? And then I have a follow-up question. Godfrey R. Sullivan: We have -- when we have those ELA-type discussions, it's often about what -- I mean, for us, it's still about data volumes because like -- you can roughly approximate a 50-gig Splunk license in a large installation to a Quad-Core server, and so, okay that's the level of performance you'll get in order to do X, Y and Z. And then when you put 10 of them together, you get up to enough terabytes and you're talking about a significant amount of hardware for indexing, search heads, distributed, storage, all that sort of thing. So it's a deployment. So the customers who want to have that conversation actually don't mind still using our data volume, our indexing volume as a proxy for how big, big is. So no, it hasn't really been -- as long as the price per gig is reasonable and the way they can pay for it is reasonable and the way our deployment model is done is reasonable, they're pretty happy. So no, I haven't -- it's quite possible we could look at other models. But for right now, the conversation still reverts back to indexing capacity. James N. Gilman - Drexel Hamilton, LLC, Research Division: And the last 1 here is, I don't know if missed this when we were talking about metrics. Last quarter, I think you had -- if I heard -- if I had my data correctly, 11-figure -- 11 deals that were above $1 million. Did you give out the number? I know you mentioned there are several, could you quantify that? David F. Conte: Yes. We did give out 11 were in terms of 7-figure transactions in the fourth quarter, 25 for the full fiscal year last year, but that's a metric we'll likely just give on an annual basis.
Operator
And we do have time for one final question. Our final question for today's event will come from Derrick Wood with Susquehanna. Rakesh Kumar - Susquehanna Financial Group, LLLP, Research Division: This is Rakesh Kumar for Derrick. My question is for Godfrey. I just wanted to follow up on the BNY Mellon example with the Microsoft Exchange app, do you see that as a trend where apps lead the conversation for new business? Godfrey R. Sullivan: You broke up there. Can you say -- I heard Bank of New York Mellon and Microsoft Exchange app, and then you blanked out, can you say the last part again? Rakesh Kumar - Susquehanna Financial Group, LLLP, Research Division: Yes. Do you see that as a trend where apps lead the conversation for new business? Godfrey R. Sullivan: Oh, thank you. Yes, absolutely. You have to have an entry point to go in to a customer. You're always looking for a way to identify the technology that you have with a pain that your customer has because that pain is likely to be where they've allocated budget or where they've allocated organizational attention. So to just go in and say, "Hi, I have a logging engine," is not sufficient to generate the kind of attention you want. So a big part of the attraction of these apps is we're able to go right into. They're like a sharp entry point. You can go right into the department where they're managing the F5 load balancers or the Palo Alto Networks or the Microsoft Exchange environment, or the guy who's running Active Directory. These guys have specific pain in the back that you can show them almost immediately how Splunk can solve the problems they have becomes a real accelerator, and it's also a real accelerator on deployment because Splunk deploys rapidly now, but with an app on top of it, you further accelerate the time to live deployment. So yes, it's -- the apps are a significant advantage.
Operator
Thank you. And that does conclude our time for questions. I'd like to turn the program back over to Ken Tinsley for any additional or closing remarks.
Ken Tinsley
That's great. Thanks, Huey, for all your help today, we appreciate it. And thanks, everybody, for your participation, have a good evening.
Operator
Thank you, sir. Again, ladies and gentlemen, this does conclude today's conference. Thank you for your participation and have a wonderful day. Attendees, you may now disconnect.