Splunk Inc.

Splunk Inc.

$156.9
0.39 (0.25%)
NASDAQ Global Select
USD, US
Software - Infrastructure

Splunk Inc. (SPLK) Q3 2014 Earnings Call Transcript

Published at 2013-11-21 22:30:06
Executives
Ken Tinsley - Former Treasurer and Director of Investor Relations Godfrey R. Sullivan - Chairman, Chief Executive Officer and President David F. Conte - Chief Financial Officer, Principal Accounting Officer and Senior Vice President
Analysts
Philip Winslow - Crédit Suisse AG, Research Division Sandeep Madhur - JP Morgan Chase & Co, Research Division Heather Bellini - Goldman Sachs Group Inc., Research Division Brendan Barnicle - Pacific Crest Securities, Inc., Research Division Keith Weiss - Morgan Stanley, Research Division Brian John White - Cantor Fitzgerald & Co., Research Division Aaron Schwartz - Jefferies LLC, Research Division David Wang - Barclays Capital, Research Division Edward Maguire - CLSA Limited, Research Division Steven R. Koenig - Wedbush Securities Inc., Research Division
Operator
Good day, ladies and gentlemen, and welcome to the Splunk, Inc. Third Quarter Financial Results Conference Call. [Operator Instructions] As a reminder, today's conference is being recorded. And now, I would like to turn it over to your host, Ken Tinsley, Splunk's Corporate Treasurer and Director of Investor Relations.
Ken Tinsley
Great. Thanks, John. Good afternoon, everyone. With me on the call today are Splunk's CEO, Godfrey Sullivan; and CFO, Dave Conte. This call is being broadcast live via webcast. And following the call, an audio replay will be available on our website. Hopefully, you've received a copy of the press release. If not, it's also available on our press release -- on our website. On this call, we will be making forward-looking statements, including guidance for our fourth quarter and fiscal 2014; uses of our software; planned investments; customer purchasing patterns; trends with respect to the size and type of license sales and the resulting accounting treatment associated with such sales and the adoption of new products. These statements reflect our best judgment based on factors currently known to us and actual events or results may differ materially. Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information. We will also discuss non-GAAP financial measures, which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP to non-GAAP results is provided in the press release and on our website. With that, let me turn it over to Godfrey. Godfrey R. Sullivan: Hello, everyone. Welcome to the call. Q3 was an exciting quarter as we expanded our product portfolio, including Splunk Enterprise 6, our release of Hunk for Hadoop, our enterprise cloud offering, a new app for VMware and a partnership with Amazon Web Services. Revenue for our fiscal third quarter was $78.6 million, up 51% compared to last year. License revenue was $50.9 million, up 47% compared to last year. We're delighted to welcome more than 450 new customers to Splunk and now have more than 6,400 customers worldwide. New and expansion customers include: Tesla Motors, The NASDAQ, ING DIRECT, University of Sydney, Urban Outfitters, UCLA and Intuit. The story for Q3 is about widespread geographic success, enterprise adoption and a record quarter in our public sector. We closed several large transactions in the Department of Defense, in the civilian agencies and state and local government. Specifically, the U.S. Army, the U.S. Air Force, the State Department and Texas Health and Human Services Commission, all significantly expanded their use of Splunk, a record quarter driven by security and operations use cases. In addition to our success in the public sector, we also made progress with enterprise adoption of Splunk. This quarter, Intuit, a long-time customer, made Splunk their enterprise standard with a multiyear enterprise adoption agreement. Intuit purchased multiple products, including Splunk Enterprise, Hunk, and our premium apps: Enterprise Security, VMware and PCI. Intuit already uses Splunk in many departments, and this expansion will give them capacity for many more use cases, including customer analytics, driven by clickstream mobile data. Quoting Tayloe Stansbury, the CTO of Intuit, "Splunk software is one of the cornerstone technologies that helps Intuit continue to innovate and deliver the world's leading business and financial management solutions." Cornerstone technology is quite a compliment. We appreciate it, and one that we strive to earn at every customer we serve. One of our new customers is The NASDAQ OMX Group. The CIO brought us in for security and IT operations for Directors Desk, an application that provides a paperless boardroom for secure information sharing among Boards of Directors. NASDAQ expects Splunk to increase uptime, cut resolution times and make the application more secure. In the future, NASDAQ expects to use Splunk to gain operational insight into user experience to drive product design. As we expand our portfolio of products, we're investing in talent to drive the next phase of innovation. This quarter, we announced the promotion of Stephen Sorkin to the position of Chief Strategy Officer. In addition to scaling the engineering organization over the last 8 years, Stephen has pioneered a number of inventions in Splunk's software and currently holds 11 U.S. patents. With deep technical experience and intimate knowledge of our customers, he's a great addition to our exec team. We're also pleased to welcome Todd Papaioannou to the Splunk exec team as our Chief Technology Officer. With his proven expertise in Big Data, cloud and open source, Todd will help define our long-range architecture. I'd also like to take this opportunity to thank Erik Swan for 10 years of innovation. Erik will continue to be an advisor to me and the team while he enjoys life with his family in Tahoe. That actually sounds pretty good to me. One of the most fun things about working at Splunk is the innovation that our customers bring to us. A few examples from the Internet of Things. From New York Air Brake's presentation at SplunkLive! Dallas last week, before Splunk, they were stuck in Excel hell with monthly reporting of their control systems. Now with Splunk, realtime reporting of train events, including throttle position, breaking effort and fuel usage. Now they can ensure driver-compliance, smoother travel, minimizing the in-train forces, which will waste fuel and damage goods. Interestingly, only 20 megabytes of data per month per locomotive. But with 18,000 locomotives running in the U.S. alone, they tell us that 1% fuel savings can equal about $1 billion. So every little improvement matters. Another SplunkLive! presenter from Multimedia Games out of Austin, before Splunk, manual log collection and monthly reporting from their business analysts. With Splunk, realtime collection of machine performance. The benefits, improved game placement, gained profitability, improved service delivery, preventing downtime and improved decision-making. To quote our customer, "We are changing the way the we deliver gaming services, and we've evolved into making business decisions with Splunk." And finally, Ford Motor Company. Using Splunk to collect and analyze data from electric and gas-powered cars. A few weeks ago, Splunk employees hit the streets of San Francisco in a Ford Focus electric car and a gas-powered Ford Escape. We used the Ford OpenXC, their API for cars, to gather, index and analyze the data in Splunk. Analysis of acceleration showed that drivers are more aggressive in electric vehicles from a standing stop. I'm sure one of them. The OpenXC API will enable Ford to better understand energy consumption and driver behavior and ultimately vehicle design. And to no surprise of any of us on Team Lemons [ph] , Erik Swan received honorable mention in the press release for having the lead foot. Now on to the product update. This was a milestone quarter for our product teams. First, Enterprise version 6, our biggest release ever with more than 2,000 new features. Version 6 brings the power of operational intelligence to more users through data models, the pivot interface and a high-performance analytic store. Analytics are faster and easier for technical users and now more accessible to business users. The release of Splunk 6 was a key reason in Q3 that IDT Corporation expanded their use of Splunk, making Splunk their company-wide platform for operational intelligence. IDT is a leading telecommunications and payment services provider that first selected Splunk for security and then expanded to IT operations in what their CSO likes to call, "Splunk usage creep." With the new pivot and data model capabilities in Splunk 6, IDT expects its business and marketing teams to be able to identify and target new markets leading to new revenue streams. They also installed a number of security apps, including Enterprise Security, PCI and the Splunk App for Palo Alto Networks to defend against advanced security attacks and also for fraud protection. Now on to the cloud. At our user conference, we introduced Splunk Cloud, which delivers Splunk Enterprise as a cloud service for large scale production environments. We also announced that Splunk Storm, our cloud service for developers, is now free. And since that announcement, we have added more than 1,000 new projects. White Ops and Funtomic are 2 beta customers who participated in the beta for Splunk Cloud and now have purchased Splunk Cloud in Q3. Annual subscription plans are available from 50 gigabytes per day to 1 terabyte per day, with custom options available outside that range. One of the strengths of Splunk is that customers can use it on prem, in the cloud or in hybrid environments. Building on that, we also announced an expanded partnership with Amazon Web Services. The release of the Amazon Machine Image or AMI for Splunk Enterprise and Hunk makes it easy for customers to use Splunk products in Amazon Web Services and will soon have a subscription pricing model available for those customers. This quarter, we announced the GA of Hunk, a fully integrated analytics platform for Hadoop. It enables users to interactively explore, analyze and visualize historical data at rest in Hadoop. I spent the last several weeks on the road in Asia and hosted several CIO luncheons. None of those CIOs had Hadoop in production, and only a few of them were in the dev test stage. All of them were thrilled to hear that Hunk can remedy these well known, long term development cycles by delivering analytics in hours, instead of months. More than 100 companies took part in the Hunk beta program and early feedback is universally positive. Hunk is available for a 60-day trial with no limits on the size of data or number of nodes. Another milestone. Splunk made our first acquisition in Q3, when we acquired BugSense, a leading analytics solution for machine-generated data for mobile devices. BugSense accelerates our ability to collect and analyze mobile data directly from the mobile handsets. Their expertise in mobile, combined with Splunk's platform, will be a compelling combination for our customers. The Washington Post, one of our enterprise customers, integrated BugSense into 3 of their mobile application projects shortly after we announced the acquisition. The Post currently uses Splunk for performance analytics related to the video experiences for PostTV. On to our premium apps. They continue to be a driver in many of our opportunities. And the app for Splunk for Enterprise Security had its best quarter ever. The Erie Insurance Group is a new customer to Splunk. Erie is a Fortune 500 company that provides auto, home, life and commercial insurance. With a high-volume, customer-facing website, Erie needed improved security for both internal and external threats. The security lead on the Erie project had come from Cisco, a long-time customer and partner of ours. So he knew us well and brought us into Erie, knowing that Splunk could rapidly improve their security posture and deliver immediate value. The U.S. Department of Energy expanded their commitment to Splunk and standardized on Splunk for security at 2 different sites with our Enterprise Security app, replacing a legacy SIM vendor. The app also continues to receive industry recognition and was recently named Best SIM by the readers of Info Security magazine. Now on to the developer community. Splunk 6 introduced the Splunk Web Framework, which helps developers quickly build Splunk custom apps. Both customers and partners are building new apps with this new web framework. We now have more than 450 apps on the Splunk website, and we added about 25 new technology partners in the quarter. One partner, Thycotic, announced the Secret Server app to help identify insider threats. That is such a cool product name; I love it, Secret Server. In Taiwan, our partner Systex announced SBOX, the first appliance built for Splunk Enterprise. SBOX is built specifically to maximize performance for Splunk, preloaded with a lightweight OS and Splunk software and is ready for deployment out of the box. SBOX is now available for our APAC customers through Systex and their reseller network. In closing, we'd like to thank everyone who attended our user conference in Las Vegas. Our customers presented some amazing material and we always come away with being more energized about the future and also about the potential for innovative use cases still to come. My favorite quote of the quarter, from a recent CIO forum, a Fortune CIO said with enthusiasm, "My team is drunk on Splunk." Thanks again to our customers, our partners and to our field organization. And now over to Dave. David F. Conte: Thanks, Godfrey. Good afternoon, everyone. Thanks for joining us. So as you can see from the financials in the release, we had a strong quarter, beating our expectations. And obviously, I'm pleased with our performance and overall execution. Third quarter revenue was $78.6 million, a 51% increase over Q3 of last year, while license revenue grew 47%, totaling $50.9 million for the quarter. We saw more evidence of adoption and expansion of Splunk throughout our customer base. More than 70% of our license bookings, again, came from the existing customers in the form of upgrades and expansions. We also added more than 450 new customers, the most in any quarter, and recorded 207 orders greater than $100,000. On the field side, we continued to build our capacity. We grew our quota carriers from 189 to 204 during the quarter, about 58% of which were tenured 12 months or more as of October 31. We remain on track to end this year with approximately 220 field reps overall. On our last few calls, I described enterprise adoption arrangements or EAAs. These structured transactions are typically larger orders and are intended to drive broad adoption of Splunk by providing our customers with a scalable Splunk license to enable them to expand their use cases. These transactions often contain elements which require them to be deferred and treated ratably in terms of revenue recognition. In Q3, the Intuit order, which Godfrey detailed, was a 7-figure transaction. Our largest in the quarter, and was an EAA. Intuit has been a long-standing customer of Splunk, having deployed several terabytes of indexing capacity over time. As they look to standardize their machine data on Splunk, we provided them a multiyear license, which allows them to broadly deploy our products and has the visibility and predictability from a cost and budgeting perspective. Consistent with other EAAs, this transaction contributed to the overall growth in deferred revenue in Q3. EAAs have become an effective structure to drive Splunk adoption for larger customers, and we expect more of these types of transactions, particularly in the back half of our fiscal years. The mix between term and perpetual bookings has been highly variable based on customer buying preferences. And we expect to see continued variability not only in this mix, but also the number, size and timing of enterprise adoption arrangements. As I've said, the combination of term transactions and enterprise adoption arrangements could represent anywhere between 20% and 30% of license bookings in a quarter. Both of these types of transactions typically result in deferral upfront and revenue recognized over time. As evidence of the variability of the mix, in Q3, 33% of total license bookings came from these -- from the combination of these types of transactions. It's possible that this 20% to 30% range could increase even more, depending on how our customers adopt our new subscription products like Hunk and cloud. Recall, we sell Hunk as an annual subscription consistent with the Hadoop distributions. And as you'd expect, cloud is sold as a subscription service. We also recently announced the availability of the new Amazon Machine Images or AMIs for Splunk Enterprise 6 and Hunk. Within the next several months, we're planning to make these AMIs available to customers on a subscription basis. All of these product offerings will generate revenue ratably. Now turning back to the quarter. Our maintenance renewal rate was 94% in Q3, the sixth consecutive quarter it's been greater than 90%. Customers also continue to utilize our Professional Services and educational offerings to accelerate adoption, which together represented 7% of revenue in Q3, consistent with past levels of 5% to 10%. At our Worldwide Users' Conference last month, in conjunction with the launch of Splunk Cloud, we provided an update on our Storm service. With over 400 customers and more than 5,000 projects, we announced that we would make Storm available to customers at no cost going forward. Developers can continue to benefit from Storm capabilities in their application development efforts now at no cost for the service. As a result of this conversion to a free service, accounting rules required us to take a noncash charge for previously capitalized Storm R&D expense, which is included in cost of services on the income statement. For consistent presentation of our Q3 operating metrics, we're excluding this nonrecurring charge, as well as noncash stock-based compensation, employer payroll tax expenses related to employee stock plans and BugSense acquisition-related expenses. Q3 overall non-GAAP gross margin was 91%, in line with prior quarters. Non-GAAP operating income was approximately $900,000, representing a positive margin of 1.1%, better than our expectations and reflective of our higher-than-forecasted revenues. Non-GAAP net income for the quarter was $400,000 and EPS was $0, based on a weighted average share count of 118 million shares. DSOs were on the low end of our expectations at 63 days, while cash flow from operations was $13.3 million. Free cash flow was $9.3 million, reflecting $2.5 million for our San Francisco headquarter expansion and we ended the quarter with about $350 million in total cash. As we stated, we'll continue to run the business on a positive operating cash flow basis. Looking forward, we expect Q4 total revenues to be between $88 million and $90 million, with license revenues contributing about 2/3 of the total. As a result, we're increasing our full year revenue expectation to now range between $291 million and $293 million. Recall and please note that in Q4 of last year, we booked a $20 million EAA, 100% of which was reflected in deferred revenue at the end of that period. When modeling deferred revenue for Q4 this year, you should consider and adjust for that transaction. Generally, it's better to look at deferred revenue on a sequential basis versus applying the year-over-year growth rate. Consistent with prior years, we expect Q4 will be our most profitable quarter of the fiscal year. We expect Q4 non-GAAP operating margin to range between a positive 6% and a positive 8%. Combining our year-to-date results and Q4 outlook, we still expect full year non-GAAP op margin to be about breakeven. Remember, because we expect non-GAAP profitability in Q4, you should use a fully diluted share count of about 120 million shares when calculating EPS. With the expansion of our product suite, including Hunk, Cloud, our apps and platform development, we're enabling our customers to adopt Splunk across their organizations and realize substantial and rapid time to value from analyzing their machine data. Overall, Q3 was strong, and I'm pleased with our results. Appreciate all your time. And now we welcome your questions.
Operator
[Operator Instructions] And we will take our first question from Phil Winslow from Crédit Suisse. Philip Winslow - Crédit Suisse AG, Research Division: Godfrey, I know you don't like to use the P word, but we've always sort of viewed Splunk as having the potential to evolve into a data platform. And I guess my question for you is, when you kind of take the feedback that you got from .conf when it came to Hunk or just the more and more of just enterprise adoption agreements that you're seeing, where do you think you are in sort of that progression from being a tool vendor to actually a data platform? And then I just have one follow-up to that. Godfrey R. Sullivan: Well, gosh, I guess I was the guy in a company that was the hardest on everyone to not use the platform word. And it really came from the early days when the Geoffrey Moore gang came over to see us and kind of cautioned us about trying to grow from a tool, to a solution, to a platform. And back in the days when we were widely seen as just a query tool for logs, to use a platform terminology would be just jumping levels and getting way ahead of ourselves. So I was pretty hard on the company and said, "Guys, don't use that term until customers use it." But once customers start to acknowledge that you're a platform, it's probably okay to go ahead and say it. So this is probably the year, 2013 specifically, is the year when I've said, "Okay, it's probably okay for us to call ourselves a data platform now because all of our customers do." So you can call that resistant or totally conservative marketing, if you want, but I kind of felt like it needed to be true before we've said it. And I believe it's true now. Philip Winslow - Crédit Suisse AG, Research Division: Got it. And then just a follow-up for Dave. Dave, one of the questions we get is about the quota carrying sales heads this year and then how it affects sort of next year's license growth. Maybe you could help us walk through how long it takes to bring on reps? And then sort of obviously, you're not giving next year's guidance, but how we should sort of think about the effect of that? And also, I guess a follow-up for Godfrey, too. One of the things you did mention at .conf was you're potentially starting up with some relationships with systems integrators, which is obviously not a -- has not been a big challenge for you guys in the past. How do you put all those together when you think about the time between quota-carrying heads, systems integrators and license growth? David F. Conte: Yes. Phil, thanks. We obviously measure time to productivity for our reps every quarter. And it's still over -- globally, is 9 to 12 months before we see new folks becoming what we call fully productive. I do think some of the challenges that we're evaluating in terms of how that metric moves or how that time to productivity changes, is moving from single product to multiproduct. So with the introduction of Hunk now going directly from the field with cloud, adding premium apps like VMware, how will these extra skill sets that we need to get spread through the field impact that time to productivity? Only time will tell. But as we look forward and build our own model, we're still using the 12-month time-to-productivity metric. Godfrey R. Sullivan: For the second part of the question around the SIs. So this has been a long case like the platform word because this takes a long time in a market such as ours for this to come about. One of the core strengths of the Splunk company and the product is that it downloads easily, it deploys easily and provides immediate value. And that's generally not consistent with how the SIs make money, given that they tend to make money from large-scale integration projects and heavy resource implementations. And Splunk just hasn't been like that. It's only now and more recent times. I think in Q3, one of our large orders was actually with a partner, with an SI partner. In general, it's taken a while for this to come around because you need to grow inside of a customer to a pretty large footmark [ph] print. I would say to a platform footprint before the integration work, the connectivity, the other data sources and databases, the dashboards and reports and alerts and all those mechanisms that are getting built gets to a scale where an SI can make money off of it. So I think we're starting to reach that. But it still is only in our largest customers that we see that intersection taking place. For the most part, it's still a Web 2.0 model driven by outside salespeople, inside salespeople, the web and regional VARs. But I think we'll get more business from the SI partnerships as time goes on.
Operator
And our next question comes from John DiFucci from JPMorgan. Sandeep Madhur - JP Morgan Chase & Co, Research Division: This is actually Sandeep Madhur on for John. I guess kind of a follow-up to Phil's question, if you could talk a little bit more about the momentum you're seeing in some of the larger deals that you're signing, clearly, I guess over 207 this quarter versus 163 last quarter, and the trend seems to be getting better. And also if you could talk specifically about the public sector and what you saw specifically in this quarter or I guess the record kind of public signings that you had. David F. Conte: Sandeep, this is Dave. Clearly, we're very happy to see the results in terms of the number of large transactions topping 200 for a quarter, for the first time greater than $100,000. Interestingly though, our overall ASPs remain consistent over the last 3 years. And that's been anywhere between $30,000 and $40,000. Obviously, that's just math. The overall amount of business that we're generating transactions below the $100,000 milestone have been growing equally. So we do see customers making larger purchases as they become more familiar with the product. And they move from single department to multi-department. And they gain that value in terms of correlating multiple data sources together. I think that's a big component of it. And then importantly, I think it was probably 3 years ago, when we started to transition from primarily an inside sales team to one that's now 2/3 weighted to a direct sales team. So we're getting higher in the organization and the awareness of what Splunk is doing and the value that we bring is becoming more prevalent in the market. Godfrey R. Sullivan: To the federal question, Sandeep, so I guess as a prelude, I think our field organization just did an exceptional job this quarter all over the world. So it was strong commercially everywhere. Fed was particularly strong, really driven by the security use cases. So whether it's the Mandiant report or need for just better visibility or additional forensics, Splunk is really emerging as the standard for how they want to do forensics. And so our team in federal just did a -- and state local was actually quite strong there as well. But the difference was, in state and local, some of the use cases tend to be a little bit more classic IT ops, where federal is a little bit more heavily weighted towards security use cases. But I'd just say, all in all, it's just -- it was great field execution driven by a strong demand in the government sector for security. Sandeep Madhur - JP Morgan Chase & Co, Research Division: Great. I guess just a quick follow-up to that as well, I think in the past you've mentioned that the core use cases still account for about 90% of the total deployments of Splunk with regards to IT ops and security. I was just wondering, with regards to sort of the more BI use cases, what do you need to see -- or what needs to happen for you to get a better sense if that use case is going to be more than sort of a 10% use case? Because it seems like you have the product integrations. It seems like Splunk Enterprise 6 is also easier to use. You're addressing a broader audience of consumers. But just if you could maybe talk to that, that would be great. Godfrey R. Sullivan: I agree that -- in fact, I think 2014 will be the year where we really start to see that accelerate. We may not talk about it as much as perhaps we should just because a lot of the initial purchases for us tend to be either in the app management, IT ops or security use cases. But they all grow from that point to becoming a business analytics use case. So my example about the gaming company out of Austin, they started using us for infrastructure and diagnostics around their gaming machines and found very quickly that they could use us actually to determine where to put the machines, which ones were most popular and how to make those systems perform better. So when they talk about using Splunk for business decisions, it was an outgrowth from the original sort of IT use case into a business use case and we see that in almost every one of our large-scale customers. So maybe we need to explain -- it's a hard thing to explain from a standpoint of what happened first. So -- but I think 2014 will be a fascinating year in terms of growth in the business analytics, web intelligence areas because Splunk 6 gives an easier interface to get that done through the data models, the pivots, the high-performance store. All that stuff is really playing right at that sort of operational analytics business. So good question. We'll try to do a little better job of explaining more of how those use cases are coming about as we go into the future quarter calls.
Operator
And our next question comes from Heather Bellini from Goldman Sachs. Heather Bellini - Goldman Sachs Group Inc., Research Division: I have 2 questions. One, I wanted to ask what you make of Amazon's recent Kinesis announcement from their conference last week and two, can you share with us the uptake in the quarter of Splunk Cloud and how you see this as a revenue driver for calendar '14? Godfrey R. Sullivan: Heather, Godfrey here. Well, Kinesis is good for everyone because it gives more companies exposure to their logs. So just like Salesforce publishes their logs and customers can get access to it, and we do a pretty good job of analyzing those, it's really important that more and more of the cloud providers begin to publish those log formats. I didn't talk about it on the call, but we also improved -- released an improved version of the Splunk App for Amazon this past quarter and our customers love it because you can point that app uphill at your Amazon instances and get better day-to-day reporting on which ones are actually running workloads and which ones are sitting there chewing up cycles that you're paying for that actually aren't doing any work. So there's a lot of interest in this whole Amazon-to-Splunk connectivity and we plan to capitalize on it, not just our AMIs, but actually just better presence overall. To the cloud piece, I think it's quite early there still because the sales cycles for those larger deployments, these are operational use cases we're deploying. They're really not any different than Splunk Enterprise. They just happen to be running in the cloud instead of on prem. And the customers want to load up the data sources and try to -- try it out and see how it works. And the POCs that we're running right now look an awful lot like our core business, but they are running somewhere else. And customers are excited about it. And we have a lot of very interesting projects in the pipeline. I think after the next -- I think next quarter's call will be a better time to do a readout on that because we just announced the service a few weeks back.
Operator
And our next question comes from Brendan Barnicle from Pacific Crest Securities. Brendan Barnicle - Pacific Crest Securities, Inc., Research Division: David, I have one for you. You talked about a larger percentage of revenue, 33% I think you said, coming from enterprise agreements. That was larger than you had expected. And you still had strong revenue upside. Is there a way to determine what the additional revenue you might have seen that ended up maybe perhaps being deferred because you ended up at 33%, say, as opposed to maybe like the midpoint of your range at 25%? David F. Conte: Well, I mean, you obviously can do the same calculations that we can in terms of derived bookings. And it's ultimately geography, Brendan, between revenue and deferred. I think we give the metric of 20% to 30% because we continuously talk about this variability in terms of the combination or the mix of how a customer purchases a product: term, perpetual, and what we consider more strategic, these adoption transactions, enterprise adoption. So at this absolute level, any small set or in some cases, as in Q4 of last year, when we recorded a $20 million transaction, any small set or individual transactions that are large can skew that percentage. And I think that's certainly the case this quarter. If you look at all of the financial metrics, and I mentioned it in my opening statement, we exceeded our own expectations for the quarter. And I think that's reflected in revenues, deferred and, of course, what you can calculate in terms of derived bookings metric. Brendan Barnicle - Pacific Crest Securities, Inc., Research Division: And then you gave us the number of deals over $100,000. But I don't think I caught the number of deals over $1 million. Did you provide that this quarter? David F. Conte: I did not. The last time we gave the metric was on our Q4 call. It's something we'll consider doing again, but not a recurring metric we're providing on a quarterly basis. Brendan Barnicle - Pacific Crest Securities, Inc., Research Division: Great. And then lastly, Godfrey, you obviously gave a lot of examples today about improvements in business analytics and web analytics use cases, yet that's still a pretty small minority of overall uses. How much do you think those use cases could ultimately become as a percentage of businesses when you think about the business longer term? Godfrey R. Sullivan: It's equivalent to any of our other core segments. If I were looking out several years. I think you'll see an even-ing out of use cases between what I would call operational analytics all up and out, including web-type use cases, Internet of Things, security, IT operations and apps. If I had to look out multiple years, I would say there will be 5 key segments that are all relatively similar in size. Therefore, the analytics segments and the IT and the Internet of Things segments are likely to grow faster even than our core segments. And when you have these platform transactions, they don't track them against one use case so it sort of dilutes the way you track your segments when a customer does a large standardization deal on Splunk. To what do you attribute that? So there's a little bit of rocket science that goes into trying and figure out all this segment information. It is not a pure mathematical exercise but I do believe that those other 2 segments will be as large as our core segments today.
Operator
And our next question comes from Keith Weiss from Morgan Stanley. Keith Weiss - Morgan Stanley, Research Division: I wanted to dig into that 33% of -- and to be clear -- of license billings from terms. So it's not just EAAs, term and EAA. Is that correct? David F. Conte: Yes, that's right, Keith, it's the combination. Keith Weiss - Morgan Stanley, Research Division: Right. So that has been tracking in the high-teens year-to-date. I think 16% to 18% over the last 2 quarters. And is up significantly from where it was last year, which I think was high-single digits. So I mean, that implies that your license billings growth was a material acceleration this quarter? Is there one in particular or one side of that equation? Was it just sort of like a bump up in EAAs? Maybe Intuit was really just that big? Or did you see just more in general term business going on in the quarter as well? David F. Conte: Well, I mean, if you turn back the clock, I used to complain about the variability quarter-to-quarter of the standalone term contribution. Hence, what was previously a 10% to 20% range and sometimes we bounce outside of that. Now adding the adoption transactions and the term together to give better visibility to you guys, in terms of how you're forecasting revenue, we upped the range to 20% to 30%. And for the first time, we reported it after initiating that range, we bounced outside of that. Again, highly dependent on individual transactions. What I will say about the standalone term business is, it was -- I'm making the statement that it is inconsistent on a quarterly basis, but it was in the upper-teens and has been generally, I'd say, for the last 3 or 4 quarters. Keith Weiss - Morgan Stanley, Research Division: Got it. Got it. That's helpful. And then in terms of the services business, you saw a really nice sequential uptick in the services business this quarter. It was up 17%. And the guide, I mean, if I take the 2/3 of the midpoint of your guidance, it seems like that ticks down a little bit in terms of sequential growth to about 9% sequential growth. Was there anything particular, anything we should be aware of in terms of maybe onetime items that occurred in that services line in 3Q that causes that downtick into Q4? David F. Conte: No. Q3 tends to be our seasonally highest services quarter and it correlates to our users conference where we deliver a fair amount of our educational services to customers. We have almost 2,000 of them captive this last year. And it's been a trend we've experienced the prior year as well, where Q3 had an uptick in services revenue tied directly to educational services at .conf. Keith Weiss - Morgan Stanley, Research Division: Got it. And then just one last one for me, a more strategic high level one. When we talk to people in the field in the industry, it seems like Splunk has hit something of an inflection point in terms of the security business, such as people being really positive of and sort of really looking at Splunk as -- one security executive termed to me, "A real security player now." Is there anything in the product in particular, maybe with Splunk 6, that really sort of turned the dial or sort created a catalyst or an inflection point for you guys in that security business? Godfrey R. Sullivan: Well, my sense of that is that it took the marketplace a while to sort of get from the yesteryear, which was a rules engine [ph] that told you when something bad happened. And that was kind of the definition of an old SIM. And with advanced persistent threats, insider threats, all this other activity going on, the market has begun to shift towards having a very flexible forensics engine that can search massive amounts of data over long periods of time. And I think it was really the RSA Conference of 2 years ago, not this February, but last, where we kind of became the darling of the show and everybody was talking about the sort of the old SIM is dead. The new way of doing it is sort of this analytics, forensics search definition. And since that time, our business has continued to strengthen. So I think we're finally getting some recognition that it really is about the search capability that makes it so powerful. And then now having a good app on top, it kind of gives you the best of both worlds. You have the forensics capability of the engine. You have a really fine app on top. It gives you the reporting and analytics that you need. And then you have the kind of tailwind of, it's been a really bad marketplace out there this year in terms of attacks and disclosures and information. And it's put a little bit more pressure on organizations to make sure that their search posture is as good as it can be. So I think it's kind of a combination of all those things, and it continues to be very healthy. But Splunk has a reputation in the security market now that we certainly didn't have 2 or 3 years ago.
Operator
And our next question comes from Brian White from Cantor Fitzgerald. Brian John White - Cantor Fitzgerald & Co., Research Division: Godfrey, just got a question on products. You're essentially moving from a one product company to a multiple product company. And I'm just curious how you think about revenue distribution. So Splunk Enterprise is the majority of your revenue today. I'd be curious where you see sales outside of Splunk Enterprise in say 12 to 18 months because you've got Cloud, which is Enterprise in the cloud, Hunk, BugSense and, obviously, you have Storm. So if you could just give us a view of how we should think about some of these new products as a percentage of revenue? Godfrey R. Sullivan: I don't know. I haven't been very good at forecasting that just yet. It's like -- I keep saying that pretty soon the international markets will be a much higher percentage than the domestic because smaller numbers will grow faster than larger ones. And yet here we were again for several straight quarters, where international is still 21% of the business because domestic keeps growing so fast. So let me answer your question with a disclaimer that I seem to be a pretty lousy forecaster. And that will be that -- if you just use logic, it would tell you that some of these new entrants are going to grow on a percentage basis faster than the core product and therefore, they should start to capture a larger and larger percentage of our revenue. And that's how typical product diversification works. I guess I'll have to let those products prove me out there because they have some catching up to do. Brian John White - Cantor Fitzgerald & Co., Research Division: Okay. And how about the public vertical? Obviously, it sounded like federal was very strong. Just to remind us, what is public as a percentage of revenue for Splunk? Godfrey R. Sullivan: Well, we don't disclose that, but it's comprised of the DoD world, the civilian agencies and, organizationally, also state and local. All that rolls up into one team out of our East Coast, our D.C office, but we haven't actually broken that out. Brian John White - Cantor Fitzgerald & Co., Research Division: Okay. Could we assume, though, it's over 10%? Is that fair? Godfrey R. Sullivan: Bigger than a breadbox. Dave, what would be the... David F. Conte: Obviously, it bounces, as you would expect. And our Q3 crosses the federal fiscal year end. So Q3, our public sector always contributes more than it does any other quarter. It has a greater percentage of its contribution in that quarter relative to the rest of the year. If you look at the whole year, it's certainly doing well as an individual region for us, but no more so as Godfrey mentioned as all the other regions.
Operator
Our next question comes from Aaron Schwartz from Jefferies. Aaron Schwartz - Jefferies LLC, Research Division: You talked a little bit here and on the past calls about the expansion of the existing base here on the enterprise adoption side. And I was just wondering if you look at the business at all, can you talk about for what you're seeing in terms of capacity expansion, in terms of growth as the renewals come up? And then sort of as a follow-up there, as you see customers start to add the premium apps, how do you think about that expansion over time with the addition of the premium apps? Godfrey R. Sullivan: I don't have any stats at the ready in terms of how much of our -- when our renewals team is engaged with a customer, how often does a renewal turn into an expansion. That's an interesting question. Let me go offline and do a little stat work on that. I will tell you anecdotally that I think it's pretty frequently that there is some noticeable fraction of conversations where a renewals person has been in touch with a customer all year long. We don't call them just 30 days before the renewal. We try to make sure we have a relationship all year with that customer. And oftentimes, the renewal of the maintenance agreement is where the customer is kind of making a mental decision about whether just to renew maintenance or whether to buy some additional license capacity at that time. And then we have all the co-term issues and whatever else. And they buy a little bit of license and change to maintenance. But I don't have actually a good stat on that. So let me take that offline and I'll see if I -- we can address it in next quarter's call. That's an interesting question, but I don't have a ready answer on that. What was the second part of the question? Aaron Schwartz - Jefferies LLC, Research Division: I was just saying, it's sort of related, as you see more customers adopt your premium apps, what's the influence you would expect there on the capacity growth? So probably related to some of the thing that you're doing there, I would assume? Godfrey R. Sullivan: Yes. We hope that apps and platform together make for a pretty synergistic combination that customers will be happy and sometimes an app can be dropped right on top of the existing platform with no revenue impact whatsoever. That is the core license is big enough that whenever an app is dropped on it and brings in some more data sources and causes some more daily indexing volumes, there's no impact. Sometimes, it requires more license to run that app because they're already at capacity for the other work that they're doing. And so it's not unusual at all for our field organization to engage a customer with the solution being the app, and it drives additional indexing capacity along with it. But there's not a rule of thumb that says $1 of this drives $0.50 of that or something. It kind of depends on where the customer is starting from relative to core capacity. So I wish I had a better answer for you than that. Our marketing department would love to know the answer to that question, but I actually don't know the answer. Aaron Schwartz - Jefferies LLC, Research Division: All right. Okay. And then maybe a question here for Dave on the EAAs. I know in October at user event, the way you sort of characterized those, it didn't seem like there was any standardization deal or deal that are still very unique, and you're still very early into this. How do you think about that over the next couple of years? I mean, I would assume you would get to some standardization on how these are getting done. I don't know if that's true or not. But is there anything you guys are doing internally here to drive to a little bit more to where each EAA is not really a unique different case, customer by customer? David F. Conte: Yes, Aaron, I certainly hope and expect that if you're looking 12 to 24 months down the horizon, that we'll have a more, I'd say, formulaic and repeatable rhythm to how we're doing adoption transactions. And that's just going to require us to put some mileage in the rearview mirror in terms of having more than a couple of handfuls of these deals today. So in answer to the first part of your question, yes, each one is still, I would say, a unique experience between us and the customer, driven as much by what are the individual customer characteristics as it is the way we would like to structure the transaction. Ultimately, our guiding principle is, how do we enable the adoption of the platform? And we want to do that in a way that's effective for the customer, for sure.
Operator
And our next question comes from Raimo Lenschow from Barclays. David Wang - Barclays Capital, Research Division: It's David Wang on for Raimo. First question is, if we go back to the 220 quota rep guidance you gave, that implies about 35% year-on-year growth, which is quite a deceleration from last year. I was wondering how you reconcile that with the sort of greenfield market opportunity you see? David F. Conte: Well, I think the components of revenue that's changing that we've I think been pretty -- hopefully, pretty transparent in terms of how we set expectations is, the composition of bookings is changing from what I'd consider traditional perpetual upfront rev rec to combination, where a lot -- you'll see a lot of transactions being deferred. And if you -- it's really a geography question. Is it going to hit the income statement or is it going to hit the balance sheet? So as we look forward, and we think about not just what has been our traditional term business, I think to Keith's earlier point, now the combination of term and adoption transactions being anywhere from 20% to 30% of license bookings in a quarter, plus the introduction of multiple products that are traditionally sold and our intent, of course, is to sell them as subscriptions. We see, from a forecast perspective, greater percentages of the business being recognized ratably than they would be upfront, which would have been the case, say, even as 2 years ago. David Wang - Barclays Capital, Research Division: Right. And secondly, are you seeing more startup competition in your marketplace? Someone like Sumo Logic, for example, I think, has been making a bit more noise. Godfrey R. Sullivan: No real change in the quarter relative to competition. We still see all of the same players in all the same segments. So if it's security, we've got a posse of folks that chase us around in that segment. And then if it's infrastructure or applications or business analytics or what have you, including cloud. So no real change. Just same folks showing up relative to the same circumstances. Hopefully, we're winning a lot more than we're losing.
Operator
And our next question comes from Ed Maguire from CLSA. Edward Maguire - CLSA Limited, Research Division: Actually, it's a bit of a twist on the last question about competition. Are you seeing any change in the incumbent software solutions that you may be replacing with some of the use cases? And particularly in security, I know a couple of quarters ago, Godfrey, you'd really mentioned you were starting to see that inflection there. Godfrey R. Sullivan: Yes, we knew it was Maguire. Feel good about it. It was -- like we knew exactly who you were. I did mention on the call one of our federal customers who used Splunk plus the Enterprise Security app to replace the existing SIM vendor at 2 of their locations. So yes, you would -- yes, there is still that activity going on. Splunk is being used to -- customers would rather have Splunk as the data platform and know that one of the use cases is security, than they would to buy a SIM and only have a very narrow set of use cases. So yes, that train is still rolling. Edward Maguire - CLSA Limited, Research Division: Great. And just to follow up more broadly, as you look forward into -- over the next year or 2, I mean, in terms of where you plan to invest, I mean, there's an enormous amount of momentum around the applications, and you've got a lot of partners building apps. But where do you see maybe incremental investment on the development side? Are you going to just continue to double down on the platform and look at more data sources, et cetera? Or do you see an acceleration on your part in building out more applications, maybe [ph] paid applications? Godfrey R. Sullivan: We need to do 3 things. One is -- well, we need to do about 5 things. And we need to make it easier for developers to build apps because we can't build everything ourselves. So we have to continue to evangelize and develop our ecosystem. And the web framework that we shipped in 6 is a good start in that direction because it uses Django and other really standard web dev tools, HTML and the like. So it's a lot easier for developers to make nice, beautiful applications on the Splunk engine and using all the standard tool sets. So that's one thing we have to do. Another thing we have to do is to continue to build a few more apps ourselves because there is a whole product notion in each of the markets, in security, in IT operations, in apps and business analytics, it takes more than just a great engine to deliver value to the customer. It takes a whole product that includes some content and some workflow and all that sort of thing. So yes, we have to personally invest in more content on top of the engine around those segments. And then I think there's a whole set of different issue, which is how much can we just simply not get done. And the BugSense acquisition is an example of where sometimes you have to use your balance sheet to go get some things that are build-versus-buy decisions. And that's a good example of where we took someone that has great technology. They're already on 0.5 billion, perhaps 1 billion mobile devices in terms of their forwarder, a good example of a place where you just go ahead and make an acquisition to help accelerate your roadmap. So I kind of think of it at most 3 buckets.
Operator
And we'll take our next question from Steve Koenig from Wedbush Securities. Steven R. Koenig - Wedbush Securities Inc., Research Division: I'm curious about Splunk Cloud. Remind me first, are apps running in the cloud? And then do you expect the cloud deals to become more app-driven than Splunk Enterprise? And related to that, does the cloud open up new opportunities? Or is more of a customer either-or decision between Enterprise and Cloud? Godfrey R. Sullivan: Well, cloud is a pretty open-ended question when it comes to a customer conversation. So what we really want to do is enable a customer to run Splunk wherever they want to run it. And that can be on prem, in the cloud, in a multitude of cloud options or in a combination of prem and cloud. So really, our strategy is to put Splunk wherever customers need it. Now just think about a couple of ways they can do that. One is they can run Splunk Enterprise on prem. They can run Splunk Enterprise themselves in the cloud. We have some very large customers that run us today in cloud environments like on somebody else's infrastructure. We now have Splunk Cloud as a service that we will host for you on a given specific use case. And that could be security with Enterprise Security on top of it. It could be in an IT operations case, where we're putting things like the Palo Alto Networks or VMware or a Microsoft content on top. So that's an option. And now we just announced Splunk as an AMI so that customers can go up and download Splunk in an Amazon virtual instance and run it immediately there. So yes, apps can run in all those -- in all 4 of those examples. So yes, we expect for the platform to be available in as many places and ways as customers want to digest it. And we would like to make as much content as possible available in each of those, in this case, 4 examples.
Ken Tinsley
John, that's our final question. So thanks, everybody, for joining us today. We appreciate it. I hope you have a good evening, and I hope everybody has a good Thanksgiving.
Operator
Okay. Ladies and gentlemen, this does conclude your conference. You may now disconnect and have a great day.