Description

 The Winner in Observability

The time is rapidly approaching where every company’s success or failure will depend on their effective use of software. As companies race to deploy technology that helps them retain and attract customers, the power of software has exceeded the wisdom available to operate it – an unsustainable situation. Observability solutions solve this problem by giving users the ability to collect, analyze and act upon the data generated by their technology infrastructure, security systems and business applications. We think Splunk (the “Company”) is poised to be the market leader in observability and offers a compelling return profile in the next 12 to 18 months, as well as over a longer time period.

Why Splunk is our favorite?

-          Primary research – We have completed over 50 interviews with 1) customers that buy observability and security products, 2) current and former employees of every meaningful observability vendor, 3) industry consultants who advise on purchasing and implementation decisions, and 4) technologists who develop the open-source and proprietary technologies that enable modern software operations.Our primary research suggests that Splunk is amongst the most favorable of any business we have researched in the last three years. Splunk is landing and expanding at an extremely wide range of companies; from cloud-native, webscale disrupters like Hashicorp, Zoom, and Shopify to legacy giants like TransUnion, Wells Fargo, and Aflac and even the US Census Bureau. Splunk’s current customer base includes 92 of the Fortune 100.

-          Financial strength – Splunk is almost 3x the size of the next largest company in their competitive set. They are growing annualized recurring revenue (ARR) at +50%, meaning the recurring revenue they will add in the coming year is larger than any of their competitors’ revenue in entirety.

-          Management – Splunk is executing phenomenally on a multi-year business model and technology modernization journey. They’ve maintained consistent leadership across the board throughout this process. Furthermore, they are demonstrating a strong ability to keep talent from acquired companies (see details in the M&A section near the end of this document).

-          Best in class product and ecosystem - Splunk's products are near universally recognized as the best in the market. Their role as the de facto enterprise machine data platform means that upstream and downstream software vendors make Splunk integrations their highest priority.

-          Complexity precedes inflection – Everything is in flux when a software company transitions from perpetual, on premises license sales to cloud, software-as-a-service (SaaS) subscription contracts. The nature of the product changes as the company incorporates cloud technologies, and the company’s reported revenue and margins are temporarily depressed. Splunk is transitioning much more quickly than expected. This is a very good thing, as it reflects strong demand for their new products and pricing model. Consequently, their financials have been more disrupted than expected. Investors routinely eschew complexity (Wells Fargo’s sellside model has over 2,400 rows in the cloud transition tab!). The transition discount should close quickly over the next year as reported metrics stabilize.

-          Valuation – Splunk is guiding to a three-year ARR growth rate of +40%. The average growth rate for +40% growers in Goldman Sachs’ coverage universe is 37x next twelve months (NTM) revenue. Splunk is valued at 12x NTM revenue. We believe Splunk has significant upside in the next 12 to 18 months as the Company’s financials begin to more clearly reflect the strength of their transition and the market re-rates their multiple closer to peers.

-          Compelling absolute return – Valuations for high-quality software companies are exceedingly high. Splunk is an exception. We estimate that Splunk will grow ARR from its $1.8B to near $9B over the next five years (38% CAGR). We expect that Splunk’s free cash flow margin will exceed 20% in three years, and likely will approach 30% in five. After accounting for share-based compensation, we underwrite a +30% annual return over the next five years (+270% cumulative return).

-          As an aside, we believe that software company valuations are sometimes misunderstood by investors who have traditionally focused on asset heavy businesses. Because software companies make “capital expenditures” through their income statement, profitability and earnings multiples look different than asset heavy businesses that invest through their balance sheet and amortize those expenses over several years.

Understanding the Landscape

-          The software landscape is extremely complex. Navigating the waxing and waning of multiple market trends is very difficult. A static analysis such as this write up will undoubtedly fall short of properly addressing the nuances. This is an unfortunate shortcoming because success or failure of software companies hinges on their positioning amidst the evolving software landscape, and their ability to transition from one paradigm to another.

-          We think the following seven trends are the most important developments that are driving software in 2020. Underneath each of these trends sit dozens of PhD’s, thousands of code contributors, and several current or soon-to-be billion-dollar companies.

-          Prior to 2019, Splunk sat almost entirely on the left side of this chart. Their journey from rent-taking incumbent to a cloud-native leader with increased earnings power and a much-expanded TAM is one of the more impressive stories we have come across.

-          We will detail our account of Splunk’s story shortly, but we first need to connect the trends driving software to the opportunity that’s in front of Splunk and its observability peers.

Modern Software and the Need for Observability

-          People have been monitoring systems for as long as systems have been built. I think what’s changed is that cloud environments make these systems much more complicated. They are much larger in scale. They are much wider in scope. And the lifetimes of individual components have been shrinking. It used to be that you could stand up a machine and run it for a few months. Now it’s common to stand up a container that runs for a few minutes…Monitoring that kind of activity with very high flux is a complicated problem.  – IT Visionaries Podcast, Rajesh Raman, Distinguished Architect at Splunk (formerly SignalFX’s Chief Architect), (link)

-          Cloud technologies, which is to say virtual machines/containers and services-based architecture, shatter the previously consolidated window that operators looked through to identify and resolve problems. Operating a monolithic application that is run on premises is like owning a dog. Running software in the cloud is like herding cattle. Software operations teams are presently stuck managing their newly inherited herd of services and containers with a pile of dog leashes.

-          Historically, problems running software have been identified and resolved using manual processes and human intuition. Spreadsheets, custom built dashboards, and phone trees were the rudimentary tools of choice. This approach simply doesn’t work with modern software that is complex and distributed.

-          Observability is the process of determining the internal state of a software system by analyzing its external outputs. These data outputs emit from different parts of the software stack. When analyzed together, they give insight into the health of the software estate and shed light on business performance metrics. Observability software solutions ingest, store, and query these indicators.

-          Unsurprisingly, software kicks out a bunch of different types of data exhaust throughout the stack. To date, each data type has been associated with a dedicated vendor.

o   Infrastructure monitoring gathers data regarding the health of your network. DataDog and SignalFx (acquired by Splunk) started their lives focused on this market.

o   Application monitoring surveys the health of an individual application by investigating performance metrics like transaction time, system response, and transaction volume. New Relic, Dynatrace, and AppDynamics (acquired by Cisco) have historically served these use cases.

o   Log files record interactions between software applications and users. Splunk and Elastic have targeted these voluminous and unstructured file types.

-          Companies will increasingly purchase, rather than build, observability software. Rolling your own solution is a poor allocation of scarce engineering time. Over time, much of the ingestion, storage, and querying will get commoditized and value will accrue to the vendors that most successfully apply artificial intelligence and machine learning (AI/ML). The companies with the most scale will be best positioned to win this value.

-          Due to the benefits of scale, we expect that the most successful vendors will serve the widest range of use cases. As the software landscape expands and fractures, customers are increasingly in need of the ever coveted “single pane of glass” that can give developers, security, and operations professionals (i.e. DevSecOps) a unified view.

o   Let’s also remind ourselves that the line between observability and security is disappearing because essentially it’s the same data that we use for monitoring our infrastructure that is also relevant for security. – Principal Product Manager, Elastic, ElasticON 2020 (link)

-          Splunk’s current customer base includes 92 of the Fortune 100 companies (see a list here). We expect that they will continue to leverage their market lead in security analytics, and we believe their monitoring products are quickly gaining share, particularly with marquee enterprise customers like Zoom and Shopify.

o   Zoom, the leader in video communications became a new Splunk Enterprise Security customer. During COVID-19, Zoom has helped keep the world connected. With the Splunk Enterprise security, Zoom will gain an analytics-driven SIEM, giving them visibility into potential security threats at machine speed. We are a long time Zoom customer and I'm very grateful for their support in helping keep Splunk connected… Longtime customer Shopify significantly expanded their use of Splunk, purchasing the newly launched SignalFx Microservices APM platform. Shopify is a leading omni-channel commerce platform and they selected Splunk to help maintain their high observability standards as they grow in scale and complexity. With Splunk, Shopify can quickly identify and source application challenges in their complex and distributed environment. – CEO Doug Merritt, Q2 2021 Earnings Call

Splunk Background

-          Founding stories are important, particularly for software companies. This interview with Splunk co-founders Erik Swan and Rob Das does a nice job telling the story for why Splunk exists – (link)

-          Erik and Rob realized that troubleshooting software was like spelunking through a cave with a small flashlight. Companies of all sizes across every industry were building ad hoc tools that would manually crawl through files to identify problems. With data volumes doubling every two years, and machine data growing even faster, this universal challenge would only get worse with time. So, the pair set out to build a company that would deliver out of the box tools that could ingest, store, and search through large volumes of log files.

-          Splunk was launched in 2003 and started selling commercial software in 2005. The company turned cash flow positive in 2010 with $35MM in revenue, and they completed their IPO in 2012 when revenue crossed the $100MM mark. From 2009 through 2019, revenue grew at a 58% CAGR.

Splunk Technology

-          Splunk helps organizations turn large amounts of data into actionable insight. Their technological “special sauce” resides in their ability to ingest a wide range of data types and then use proprietary search algorithms to identify and deliver valuable, descriptive information. Over time, they have built up substantial expertise and out-of-the-box tools that empower users to apply Splunk’s search capabilities to a wide range of business use cases.

-          Splunk’s data store architecture is known as “schema on read,” meaning that users don’t need to define their data structure up front. This is an important difference because it gives teams the flexibility to modify their data goals over time without needing to revisit prior decisions.

-          Unlike infrastructure or application metrics, which return data based on questions that the operators have instrumented into the application, log files are unstructured. They help teams answer the “unknown, unknown” questions.  These kinds of insights are not only valuable, they are durable and differentiated across current and future software paradigms.

Splunk Was on the Wrong Side of History

-          We have followed Splunk for most of its life as a public company. Until recently, we’ve held a consistently negative view. We would even short the stock from time to time when we needed to reduce certain long exposures.

-          Our problems with Splunk were as follows:

o   It was built on a legacy, monolithic architecture that severely limited Splunk’s ability to participate in the cloud revolution.

o   Their revenue model was geared to perpetual licenses, which is at odds with prevailing subscription-based SaaS economics.

o   Customers were unanimous and unambiguous that Splunk was too expensive and that its pricing severely penalized unforeseen spikes in usage; which is anathema to customers’ goal of building software solutions that need to scale with market demand.

o   Splunk’s software stack focused primarily on proprietary technologies, putting the business at serious risk of disintermediation from open-source communities.

-          Splunk’s case for a renaissance is best evidenced by its successful cloud transition and notably self-aware acquisition strategy.

Cloud Transition

-          Splunk’s analyst day in March 2018 (link to presentation) set out a goal for $2B in 2020 revenue and detailed their plans for transitioning the business from perpetual, on premises revenue to a recurring, cloud-deployed model. At the time, we were bearish on these prospects. We believed that Splunk would struggle on multiple fronts. We thought that their sales team would have a hard time pitching customers on more expensive cloud-hosted products when they were claimed to be fed up with Splunk’s high price tag. We also believed that migrating the technology from its legacy roots would be extremely costly, both from a dollar and time perspective. Our best guess was that Splunk’s revenue transition would get stuck in the mud, the technology would lag, and a modern competitor would quickly eat their lunch. This was textbook innovator’s dilemma. But to our surprise, Splunk has passed this once in a decade test with flying colors. Their success is meaningfully underappreciated by the market. This will likely change over the next year as the financials more clearly reflect the strength of their transition.

Source:  March 2018 Investor Presentation

-          Splunk reported 2020 revenue of $2.36B, beating their goal by 18%. More importantly, they exceeded their cloud and recurring revenue objectives by an even wider margin. As shown above, Splunk targeted a recurring/perpetual mix of 75%/25% for 2020. Actual business mix for the year was 95% recurring. Transitioning to recurring revenue is a headwind to reported financials, as revenue is recognized over the life of the customer relationship instead of upfront. The true magnitude of Splunk’s total revenue outperformance is even more impressive than headline numbers. Specifically, their cloud business is performing far above expectations.

-          Critically, Splunk’s cloud operations have finally migrated to actual cloud-native services. Historically, their cloud business was a brute force lift and shift of their on premises technology into a cloud environment. Running on premises software in the cloud is expensive and operationally intense. Splunk recently completed their cloud technology migration. We saw the fruits of this labor in the last earnings report, when 96% of the increase in cloud revenue fell to gross profit and cloud gross margins improved from 54% to 59% sequentially. This marked improvement suggests they will hit their 70% cloud gross margin goal much faster than anticipated.

-          Splunk’s recent performance is exceptional. The migration to recurring revenue and cloud deployments shows that Splunk is resonating well in the modern purchasing and technology environment. This strong performance  has yet to show up in headline financials. It will soon.

Acquisitions

-          Finally, an investment thesis in Splunk would be incomplete if it failed to discuss their acquisition strategy. Large technology companies like Oracle, SAP and IBM have a very poor reputation when it comes to executing M&A. Acquirers typically ruin the acquired business by forcing the smaller company to adopt the culture and strategies of the larger one. From a technology perspective, the acquirer’s legacy code base simply can’t coexist with more modern frameworks. This inevitably results in a mass exodus of talent, which deeply impairs the acquired company’s ability to innovate.

-          By contrast, Splunk’s acquisition strategy has worked very well. Their purchases illustrate self-awareness about where the market is going, and their ability to retain key executives is the best we have ever seen. Their recently highlighted win of Shopify as a SignalFx customer is strong evidence of their cultural and technology success.

-          Splunk has shown a remarkable ability to retain key executives from these acquired companies as highlighted in the table below (full list of acquisitions here:  https://www.splunk.com/en_us/about-splunk/acquisitions.html).

The Bear Case

Splunk is currently trading at a 50% discount to peers, and, while not abnormally high as a percent of the float, Splunk’s short interest totals $1.6B. There are credible risks to an investment in Splunk, and it’s clear that many investors have taken a more bearish view. In the short term, the covid-induced recession has forced many companies to cut their IT budgets. Splunk is an expensive software suite. Although we think the dramatic increase in the quantity and importance of machine data is a strong tailwind, there is a chance that many customers will contemplate moving to lower cost vendors, or reducing their usage of Splunk. Recently, a sellside report detailing channel surveys stated, “Partners suggest the majority of projects this Q were centered on cost optimization and helping customer limit Splunk data ingest. Work also points to large customers exploring cheaper alternatives to Splunk–namely MSFT Sentinel, ESTC, and Databricks.” Splunk’s share price underperformed the NASDAQ by almost 500 bps the day this report was published.

Longer term, it is still plausible that Splunk’s modernization will stall. As fast-moving companies in related verticals, such as Datadog, win customers at the low end and add to their product portfolio, it is likely that Splunk will eventually face stiff competition.

We take these risks seriously. Our extensive research suggests that Splunk should sustain their recurring revenue growth, and we feel confident in the informational edge that we work hard to build every day. Still, it is entirely possible that our thesis will not play out as contemplated. Understanding this, we will continue to closely monitor the technology landscape and Splunk’s execution – our research efforts continue during ownership of a security. This is an extremely large market. If we feel that Splunk is faltering, we will redeploy capital into the companies that are best positioned to build the leading observability platform.

Disclosures

This is not an offer to buy or sell a security. The ideas expressed in this posting are the views and opinions of the author of this posting (Author). Author has no obligation to update any of the information contained herein and has no obligation to update the posting to reflect any changes in the Author’s opinion on any of the companies or topics contained herein. This posting contains forward looking statements and predictions that are inherently uncertain, because the matters they describe are subject to known (and unknown) risks, uncertainties and other unpredictable factors. No representations or warranties are made as to the accuracy of such forward looking statements and predictions. Do not rely upon the information contained in this posting for making investment decisions; prepare your own analysis or contact your financial advisor. While the Author has tried to present facts it believes are accurate, the Author makes no representation as to the accuracy or completeness of any information contained in this note. Past performance is not necessarily indicative of future results, and there can be no assurance that targeted or projected returns will be achieved.

Catalyst

Revenue growth starts to reflect ARR growth. Margins return to historical levels. The market realizes the practical implications of software eating the world.