What's the problem with Splunk's share price?
Splunk (NASDAQ:SPLK) announced the results of its 2016 fiscal year (ended 1/31) on February 25th. The results were a blowout, and two Seeking Alpha contributors were felt impelled to write articles talking about the strengths of the quarter. The articles are concise and to the point, and present much of what happened during the just passed quarter and fiscal year. And yet, the shares basically have done nothing to reflect the strength of the quarter or the forward guidance.
Splunk shares did rally somewhat over the post earnings week or so, but by the end of February, the rally was over, and the shares have traded in a narrow range since that point. And Splunk shares had been rallying with the market since well before the earnings release. From the trough of $31 set on February 11th, the shares rallied to $37 before the earnings release and to $47 in the week afterwards. Essentially, Splunk shares, despite the awesome Q4 that was reported, more or less tracked the price pattern of other highly valued momentum names in the software space. The rally, while awesome from the February 11th lows, still leaves the shares down by 19% since the start of the year and down by no less than 36% since they made their high for 2015 back on July 26th.
Yes, the shares still are highly valued, at least to some observers, but far less so than they have been at any point in the 4 years or so that this company has been public. Yes, other pseudo competitors have blown up, but that happened before 2/25 - no new news there. And yes, Splunk does not make, nor will it make GAAP profits for some time to come, but it is certainly starting to generate a meaningful amount of cash. I think it is time to examine some of the negative arguments that have apparently been weighing on the shares and try to present the case that Splunk shares are significantly undervalued at their new "normal" price. A controversial thesis? Perhaps, but then again, beauty is in the eyes to the beholder, and this beholder sees a lot to like in both Splunk the company and the stock!
How does an Investor Play Big Data Analytics?
Many investors in tech have heard about Big Data for the past several years. Some will say, "But Big Data is so 2012." Others will say, "But haven't the companies in the space disappointed and been bad investments?" And still others will say, "I own Oracle or SAP or IBM, and I get my exposure to Big Data analytics that way." And finally, if all of the above objections can be successfully answered, the question is, "Why invest in market leader Splunk? Isn't it outrageously valued both in absolute terms and relative to its peers?"
Most of these objections are urban legends that come pretty close to the story about McDonald's (NYSE:MCD) and its liability for selling hot coffee. There is, no doubt, some kernel of truth regarding all of the perceived objections to buying Splunk shares, but when one really looks a bit closer, the exact dimensions of the objection seem to shrivel before one's eyes.
Splunk is, has been and is likely to remain the leader in what it does which simply put is to "make machine data accessible, usable and valuable to everyone. "The key to what the company really does is in the words "useable" and "valuable." Basically, Splunk is all about data analytics of various kinds and the ability to actually get value from all of the multiple data sources that flow into modern enterprises, but which are totally useless unless they can be catalogued, indexed, and used as part of a predictive analytics platform. The flagship Splunk product also has features that, in combination with other cybersecurity platforms, can help determine if the data being indexed has in some way been corrupted.
Splunk has never been a cheap stock using any kind of classical valuation metrics. In fact, the shares are cheaper today than they have been at any time since this company went public back in 2012. The company does spend an enormous amount of money on sales and marketing. It really did spend 82% of its revenues on sales and marketing last year, up from the 76% of revenues it spent on sales and marketing in its fiscal 2015 year (ended 1/31/2015).
The people who run Splunk are neither fools or knaves, nor have agendas that are antithetical to shareholder values. The company's initial CEO, Godfrey Sullivan, in fact, managed to sell Hyperion Solutions to Oracle for $3 billion. Almost anyone familiar with that story would have said that Mr. Sullivan succeeded in putting lipstick on one of the nastier pigs in Silicon Valley.
The current CEO, Doug Merritt has held executive product marketing roles at SAP, Cisco and a couple of valley start-ups. The company's CFO actually "worked" in various personal investing activities, and prior to that, he was the CFO of Opsware when it was bought by Hewlett-Packard (NYSE:HP). Another very dark night, but a pretty nice bonanza for Opsware shareholders at that time.
On the surface, it seems scarcely credible that a company would deliberately go out and spend 82% of its current revenues on sales and marketing. So, why has Splunk elected to pursue what seems like such a ruinous strategy? Basically, the reason why company management is comfortable with that kind of spend rate is that the customers it lands today will almost inevitably spend several times or multiple times their initial purchase on Splunk over the years. The company has a somewhat unique pricing model in that users pay for a fixed amount of data to go through software indexers, and then must pay overage charges when additional data goes through the Splunk indexers. Every year, the volume of data rises at most enterprises by as much as 50%. The bet that Splunk is making is that the huge costs associated with customer acquisition are going to be amortized through the years over a substantially higher amount of revenue than that which is being currently reported. I will discuss the Splunk pricing model in a bit more detail later on, but that model is one of the reasons why the company is likely to be one of the more profitable enterprise software vendors over the next decade.
In its last reported quarter, ASPs for Splunk more than doubled from year-earlier levels. The basic reason for the steep rise in ASPs is that Splunk offers an option called Enterprise Adoption Agreements (EAA), which, in return for much higher fixed prices, does away with ratable overage pricing. EAAs cost far more than standard Splunk licenses, and while their adoption is very far from universal, they led to record number of large deals for Splunk last quarter.
That being said, ironically, Splunk booked 53% of its business - an all-time record for the company - on ratable contracts last quarter. While the EAAs might seem to limit growth upside, at least for the customers that sign them, in point of fact, data volumes and use cases are growing so fast that they typically slop over the contractual limits of the EAAs.
Hindsight, to be sure, is 20/20. But if we might all look back on the decisions this management has made to spend a fortune on S&M and to use non-GAAP measures in measuring profitability, I think we are likely to find that the tactics were correct and will have led to great results for investors!
I really thought that the boom in Big Data was over? Didn't a whole host of competitors' crowd into the space, and aren't users discovering that the benefits of Big Data analytics were overhyped, and that Big Data projects often are big embarrassments that cost lots and do not deliver?
You remember that old story that "he who represents himself has a fool for a client? What Splunk does is relatively complex in that it takes several quite different processes and integrates them into a single, easy-to-use application. It is used to be that there were a variety of software companies which were organized and thrived on doing pieces of what Splunk does. Just to name a couple of examples that come to mind, Ascential Software, long since bought by IBM Corp. (NYSE:IBM), and Informatica, bought by Oracle (NYSE:ORCL) just a year ago, did data integration. The BI vendors, at one point, were said to do some of the things that the company, does today and they have long since been bought as well. And Splunk produces what are called data logs that are used by network security vendors to measure potential threats to the data being aggregated. In fact, Palo Alto Networks (NYSE:PANW) and Splunk have joint, tightly integrated solutions. To some extent, the current firewall technology depends on statistical logs in order to be successfully implemented.
As it happens, Splunk's biggest competitors are really not Oracle or IBM or SAP AG (NYSE:SAP), but homegrown data logs that produce primitive and custom analytics. As a user, you could go out and buy pieces of software from loads of different vendors to do what Splunk does and attempt to build a Big Data analytics solution internally. Most Big Data projects fail because the users who try to develop solutions using consultants and bits and pieces of software from multiple vendors essentially have themselves as clients and get generally predictable results.
Perhaps Big Data analytics doesn't get the hype that it might gotten 4 years ago, but the fact is that the amount of data that needs to be somehow filed and cataloged and used keeps growing exponentially. That hasn't changed, one customer specifically mentioned on the Q4 conference call started with Splunk, with a multi-gigabyte per day license. Fast forward a few years, and the license is now up to an exabyte per day. Now, it obviously isn't every customer which grows quite like that. But the point is that this customer started with Splunk with a license that was in the range of $40,000 and has now signed an EAA for in excess of $10 million. It seems likely that whatever Splunk paid to onboard that particular customer was really worth the cost - the amount of selling required with a customer like that is negligible after they decide to standardize on a supplier of packaged logs and analytics.
The latest Gartner survey says that the amount of data generated globally will increase tenfold over the next 6 years, doubling every two years. I will not speak to what kinds of data are getting created and what kinds of data needed to be indexed securely, but the fact is there are really very few areas in the enterprise software world that have such a powerful demand engine undergirding growth.
I think it is important to understand what it is that this company does that is different than the stack vendors, who certainly all have solutions in the space. First of all, Splunk is neutral as to data source. Most very large users have multiple vendors of application software whose output is machine data. To the extent that they can index data at all, they do a very poor job in indexing data from sources that are not part of their own stacks.
But, of course, the biggest issue is one of speed. The stack vendors are simply not set up to index data nearly as fast as Splunk or, for that matter, any of the specialized data indexing vendors. Splunk spends what can only be described as an unprecedented proportion of revenues on R&D. What the company has apparently gotten for the investment is technology that dramatically reduces the number of filers necessary to index the transactions. On the call, management spoke to reducing the required number of filers by 60% in two years. The BI vendors have simply not tried to spend the money necessary to create solutions that do what Splunk and its far smaller peers are trying to do.
When the company first started, I wondered for quite some time how it was that it would do a job that the BI vendors were supposed to do and had been at for a decade or more. But I think it is quite evident that, to use a rather pedestrian phrase, Splunk has simply been eating the lunch of the BI vendors in the data indexing space, and more and more users are beginning to believe that they ought to be indexing and analyzing all of their data.
Simply put, Splunk does not have the competitors that it might be expected to have, the market continues to expand at breakneck speed and the torrent of data is rising rapidly. Big Data may command far less press than heretofore, but it hasn't ceased to be a significant user priority.
I don't propose to write a treatise on the different missions of the three vendors. But think of it this way. Tableau and Qlik are companies which want to put their software on every desktop. Splunk wants all of the data of an organization to be processed by its software. Other than the fact that all of the companies involved deal with data, there really aren't analogs. Qlik and Tableau do grab data from different sources, and they do have some basic analytic capabilities that can tell users if the source of the data might be corrupted. But the goal of both the companies is to develop apps that allow desktop users to visualize the data and to create usable graphs and charts of various kinds to visually represent data as part of decision support systems. The software that Tableau and Qlik sell is not designed to index data, it isn't designed to ensure that the data is being charted or graphed or whatever comes from pure sources, and that threats to the data have been statistically analyzed.
For Qlik and Tableau to grow, they have to sell more and more seats of their technology to users. The reason that Qlik Sense, for example, is thought to be a potential savior for Qlik is that it is cheap enough and easy enough to use so that it expands the market to more and more desktops. I have written that for me, trying to get more and more users within an organization to be able to visualize data is really a counter-intuitive sale. I really do not think it is necessary or even desirable for every knowledge worker in an organization to deal with data visualization. It is a job far better left to data analysts and professionals than it being "democratized."
For Splunk to grow, the enterprise has to use more data and have more use cases. No one cares how many desktops use the software - the pricing is based on how much data is indexed per day. It is simply far, far more difficult to persuade more and more users that they need to put data visualization tools on more and more desktops than it is to tell a user that the volume of data flowing through the Splunk indexers has doubled or trebled or something like that, and it is time to get a new license.
At this point, 70% of Splunk's revenues are coming from existing customers who are developing more use cases and processing more data. The customers themselves do the selling. I do not think something like that will ever happen in the market for data visualization tools. If Splunk never sold another new name account, it would continue to grow for some years, and to the point of some observers, it would be far more profitable. If either Qlik or Tableau stopped selling, they would destroy their financial models, such as they are, within a brief span.
Again, Splunk sells much of its software on a ratable basis. Qlik and Tableau do not and cannot, and therein, is the huge difference between what the companies do and why Splunk is far less likely to blow up than the companies who are perceived by some as competitors.
How does Splunk compete with its rivals, and why should it continue to maintain the competitive advantages it has enjoyed?
I think Splunk is a company that, at its scale, really lacks direct competition from the larger software vendors. Management maintains it has an 85% win rate, and I am inclined to believe that statistic, since CEO Merritt said that an 85% win rate is a sign that the company is simply not engaged with all of the potential customers who could use its product.
Another factor is that Splunk actually partners with many of the companies that might be thought of as potential competitors. For example, at this time, Amazon (NASDAQ:AMZN) is probably the company's most important partner, and it has other strategic relationships with both Cisco (NASDAQ:CSCO) and EMC Corp. (EMC). All of those companies might be thought of as potential competitors, but they are partners instead, and these are real partnerships in the sense that the Splunk solutions are part of overall solutions sold by those companies, and their salesmen get both quota credit and normal commissions for selling its solutions.
Splunk does face numerous competitors, but most of them are companies you have never heard of before and are unlikely to hear of in the future. An industry publication called DataFox Digest listed 8 Splunk competitors. It doesn't really attempt to rank the competitors by functionality. But what strikes one in considering the list is just how small the competitors are. They are all still funded by VCs, and their funding is quite small.
Another industry publication called Quora recently put together list of potential Splunk competitors that was developed by its readers, who are mainly IT professionals. As one reviewer suggested "I have tested other solutions from the other vendors and there is always something missing." One manager who responded to the survey said that HP ArcSight and LogRhythm are the two strongest competitors in the space. While I recently wrote a positive article on HP Enterprise (NYSE:HPE), I do not imagine there is any observer who imagines that HP, at this time, is going to be effective in terms of competing with a company that has a strong sales and marketing effort.
LogRhythm is a security intelligence company. It monitors what is called log data and network and endpoint monitoring. While it is in the leader's quadrant in the Gartner analysis of Security Information and Event Management (SIEM), it is said to be significantly behind Splunk in terms of completeness of vision.
To be fair, both Tableau and Qlik are listed by another market research firm TrustRadius as competitors in the SIEM space. The users said they loved the products and reported that they presented excellent homegrown functionality. I think the issue really is that while Tableau and Qlik are focused on visualization on the desktop as a core strength, Splunk's core competency is in data analytics and data security. There isn't a one-for-one match-up.
At this point, none of the more logical suspects really offers either software or appliances that compete directly against Splunk. IBM is said to be a leader in SIEM, but if you want analytics or a broader base of functionality, you have to go elsewhere within the IBM offering before you can build a solution. At this point, neither Oracle, SAP nor Microsoft (NASDAQ:MSFT) are said to compete in the SIEM space.
Even large companies have limitations on all of the development projects they can undertake. I think it is relatively obvious that the priorities of large competitors these days is to improve their cloud offerings and not to worry so much about adjacent markets like SIEM
I think that the major takeaway in considering Splunk competitors is that for a variety of reasons, none of them really is likely to derail Splunk's overall go-to-market strategy anytime soon.
But isn't Splunk still expensive, and why does it have such a minimal level of even non-GAAP profitability?
No one is likely to confuse Splunk with a value investment as it is classically defined anytime in the near future. And the company does not enjoy the specific benefits that I see in subscription models that generate lots of cash and lots of recurring revenues. Splunk has offered a cloud alternative to its on-premise software for a couple of years at this point, and it partners with AWS and others, where it provides the vendors of cloud-based services with the tools that users want in terms of SIEM and analytics. But so far, the company's major revenue stream is license revenue, which made for 61% of total revenues last year. The percentages are changing, but not precipitously. In the prior year, the company got 63% of its revenues from licenses. We really don't know precisely the percentage of cloud revenues, and it is certainly less than half of the balance of revenues not coming from licenses, as services still makes up the preponderant share.
Splunk is growing its top line rapidly, and it has lots of momentum. But other companies in other spaces are growing rapidly as well. I think the underappreciated and not-so-secret sauce in this company's business model is its ratable pricing. Last quarter, 53% of Splunk's deals were done on its ratable model. As I mentioned earlier, Splunk has a variety of ratable options, but the standard contract essentially allows users to designate sources from which data can come, and then indexes the data so it can be analyzed. A typical Enterprise license will specify how much data a user can index per calendar day. Enterprise licenses are standard software on-premise licenses modified to provide for a fixed level of indexing volume. If more data goes through the indexers, the user has to pay tiered fees.
Given the growth in the volume of data generated by most enterprises these days, it is almost inevitable that users wind up paying significant overage fees at some point during the course of their agreements. Not all customers pay overage fees, of course, as they may have purchased adequate capacity initially, or more likely they have been pushed into EAAs. And we don't know the statistics for overage fees either, as the company doesn't disclose that type of revenue breakdown. But we know it is substantial, based on the answer given by the CEO to a question, during the last conference call, regarding the composition of the company's business mix. "That big transaction that I talked about earlier in my prepared remarks is a great example where they actually came back more than a year in advance and consumed-made sure they were able to consume significantly more. And that was a transaction that when it was assigned, the people though oh my gosh, that looks like it's just going to cover them forever." Just to make a bit of sense of the answer, what the CEO wanted to say was that a customer who wasn't yet consuming the maximum data throughput actually back to re-up a year earlier and significantly upped their data consumption levels, leading to a very large sale that was unexpected by the sales people.
To my mind, the growth in data volumes is basically a force of nature at this point, and investing in Splunk will certainly provide investors with the most direct correlation to the rapid rise in aggregate data volumes
One thing that the ratable model does is to delay the timing of some revenues. In the instance cited above, that was mitigated because the user actually wanted to stop paying overage fees and opted for a new license more than a year prior to the termination of the old agreement that brought them to another consumption tier. When users elect to buy more data throughput than they actually use, then Splunk does not account for all the revenue immediately, even if it is billed and paid for. While the company has nothing like the deferred revenue balances relative to its size that subscription vendors have, it has seen some increase in product deferred revenues that have shown up in operating cash flow.
Splunk's EAAs are very tiered, and the company has reduced, and will continue to reduce, the entry level into the new tiers to accelerate the adoption of its software into more use cases. As a result, it is even hard to hazard a guess as to how valuable new customers are going to be. But this model is, in some ways, the exact opposite of the traditional software business model. When customers buy a database license from Oracle, it is good for a certain number of seats. Almost everyone winds up buying more seats than they need, and even if that is not the case, the growth from installed customers is small. Users do develop new applications, of course, and the seat count can grow in other ways, but it isn't a significant component of the revenue stream.
With Splunk, the opposite is true. Almost all of its customers are going to consume more data over time than they signed up for. They will either start paying substantial overage fees or renegotiate their license to allow them to consume more data. It would be nice if I had some kind of data that would allow readers to figure out just how much a typical new customer is really worth to Splunk. But it is this phenomenon, i.e., the extremely rapid growth in revenues per customer over time, that has led the company to spend so much of its money on sales & marketing expenses. If one looks at sales and marketing expense on a static basis, of course the 82% expense ratio is extraordinary and not sustainable. But if one takes a look at the revenue dynamics engendered through customer acquisition, investors would actually want Splunk to spend more on S&M than it does, since it will generate so much additional revenues from the new customers that it captures as to more than mitigate the current seemingly undesirable expense ratio. It is this phenomena, at least to me, that makes the shares look like a bargain.
Obviously, the people who run Splunk are not unmindful of shareholder concerns about generating real reported net income. As the CFO commented during last quarter's call, "the Splunk model has lots of built in leverage and at our scale you are going to see some leverage." There are some signs that the company is beginning to rein in the growth of its S&M expenditure growth, although, admittedly, not from the numbers that were presented in the earnings release press release. The company reduced the growth in its quota carrying head count to 42% last year - a bit less than the growth in license revenues, and substantially less than the overall growth in product revenues, some of which are now going into the services line. It will be a balancing act between growing the user base to take advantage of the overage fees and in improving profitability.
Management guidance for the current year is for 32% overall revenue growth, and while that rate was a significant increase in guidance at the time it was given, it means growth in the current fiscal year is to drop significantly from 48% last year. The CFO said that the guidance was adjusted based on the financial turmoil seen in the world markets during January and concerns about deteriorating global macro economic conditions. Indeed, the Splunk forecast that informs consensus expectations is that most of the growth would take place in the latter half of the current fiscal year. Despite - or in some sense, as a concomitant of the expected growth slowdown - the company is forecasting non-GAAP operating margins in the current year of 5%, up from 3.8% in the prior year. But unlike some stories out there, this will never be a margin story until it ceases to be a hyper-growth story. The plan, as articulated by the CFO, is to increase non-GAAP operating margins by about 1-2 percentages points per year. That is a bit better than it might sound, as the company will gradually be getting an increasing proportion of its revenues from subscriptions, which will depress short-term revenues and margins.
Stock-based comp is not a minor item for this company, and I imagine the level of stock-based comp will deter some readers from considering an investment in the company. Stock-based comp was $283 million last year, which was over 40% of revenues. At least that was down a bit from the 47% that was recorded for fiscal 2015. I imagine that over time, the company will continue to reduce its stock-based comp as a percentage of total revenues, but it would be foolhardy indeed to expect such expenses to be less than 20% of revenues for the foreseeable future.
Splunk's other operating expenses are far greater than most observers might expect for a company of this scale. G&A is 18% of revenues. That is at least 50% above what would be considered normal for a company of this size. R&D is an extraordinary 32% of revenues. Most software companies spend half of that or less on development. So, there is really loads of operating leverage lying in plain view at Splunk. It is really a question of when and at what rate it chooses to pull the profitability levers.
Splunk is starting to generate a significant level of cash flow. For the year, the company generated $156 million in operating cash flow, up 51% from the prior year. Most of the cash flow is coming from stock-based comp as well as a significant increase in the deferred revenue balance, which was up 48% over the prior year, reflecting both the nascent cloud revenue stream, coupled with an increased proportion of revenues coming from EAAs, where some of the revenue is deferred until the customers fully utilize the capacity that they have bought.
The company's free cash flow was $104 million last year. Free cash flow was depressed last year due to one-time facility purchases, including the company's SF headquarters. It will be similarly depressed in the current year because of the build-out of Splunk's Silicon Valley campus. Normalized expenses for capex are unlikely to exceed $20 million/year after this year for the foreseeable future.
Splunk has a lengthy record of beating and raising estimates, and I have little reason to believe it will not be able to do so this year, and so far as that goes, for the estimates analysts have made for fiscal year '18. Overall top line growth should continue to exceed 30%, absent any pronounced swing to cloud deployments. There is just so much potential leverage in the company's business model that, at least for the next few years, EPS will be more a matter of company choice than anything else. Splunk is forecasting non-GAAP EPS of $.28 this year, and that is up 25% since before the earnings release last month. I would be surprised if the real numbers weren't significantly greater, although they will not enough to make this any kind of a value stock.
Some final thoughts
How much do you value a company with a unique business model that is growing at 30%+ and ought to be able to continue to do so for the at least another several years? How much is the built-in future revenue from overage fees worth to an investor? How much is the company's potentially enormous operating leverage worth to investors? And to what extent should the shares be penalized for its excessive use of stock-based comp?
I would be the last person to suggest that there is some formulaic right answer to those questions. Some readers are going to look at the level of stock-based comp and be completely turned off from any further consideration of Splunk as an investment vehicle. Some investors are going to be really enamored with the huge future revenue potential of one of the few really ratable pricing models in the software industry. And some investors are going to wonder how long Splunk can exist in a hot market without attracting far more formidable competitors than it currently deals with.
Many years ago, I worked for BMC Software. Why is that relevant? Well, BMC basically charged users in those days based on the MIPS, i.e., the size and power of the CPU that they owned. In other words, there wasn't a set price for the software products that the company sold - all of the pricing was predicated based on how many MIPS the user had deployed and that were being "managed" by BMC Software. It was really a license to print money, and of course, for some years, the company did exactly that. Of course, BMC spent relatively little on sales and marketing - it offered 90-day trials and telesales, and its R&D budget was constrained, to say the least. In the long run, that latter point did in the company.
That particular issue, i.e., spending too little on R&D, is not going to haunt Splunk anytime soon. It spends an extraordinary amount on people, even by the standards of a San Francisco-based software company. A rough estimate is that Splunk spent over $400,000 per employee last year. That is probably 1/3rd higher than typical employment costs go at software companies these days. Most of that extra amount is stock-based compensation. I think the combination of more profit-focused financial management, coupled with a rising proportion of revenues coming from overage payments will change those statistics over time.
I am not suggesting to readers and investors that Splunk shares are in the value category. But they are significantly cheaper than they have ever been since this company has gone public, and the outlook for what the company does has as much or more promise than has ever been the case. The shares are quite volatile, and they aren't defensive. But, in my opinion, Splunk is the best way to play the continued data explosion that seemingly has no end point in sight.
Disclosure: I/we have no positions in any stocks mentioned, and no plans to initiate any positions within the next 72 hours.
I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.