Thesis:

We believe Splunk is an excellent short opportunity given the company’s excessive valuation, highly speculative nature, and the expiration of the IPO lock-up agreement on 10/15/12 which will free up over 50% of the undiluted shares outstanding. We think this short position could return over 50%. We recommend shorting Splunk with a price target of $20.

Overview:

Splunk is a recently IPO’d software company that specializes in Business Intelligence. Their main product offering allows companies to utilize the massive amounts of data that they collect from log files from their IT infrastructure to help detect problems and security threats. Additionally, this data can often be used to improve business operations, customer experiences, and the efficiency of the infrastructure. The product allows users to visualize and analyze the data, as well as to correlate it across other data sources. Splunk recently launched its first cloud offering, Splunk Storm. However, the reach of this product might not be as big as some expect and it does not serve the big data market. (see http://www.sumologic.com/blog/company/splunk-introduces-cloud-offeringbut-is-it-ready-for-enterprise-prime-time). The majority of Splunk’s revenue will continue to come from its machine data software for the foreseeable future. Splunk recently adjusted guidance upward for its current fiscal year (FY 13) revenues to about 185MM. The company is operating at a net loss and produces 1-2MM in free cash flow each quarter. The main hope for the company is that it can capture a decent amount of its estimated target market of $32 Billion and cut back on sales and marketing costs to operate at a profit. Further, we believe that the consensus might be hoping for a defensive acquisition of Splunk by one of the major tech companies in this space (IBM, SAP, BMC, Microsoft, etc). Because of what the market sees as great promise, Splunk is trading at a very high valuation. It is currently trading at 22x TTM sales, and 19x FY13 sales.

Consensus View:

The consensus view on Splunk is similar to the typical tech growth story: the hope is that the company will be able to continue growing revenue at a very fast pace for the foreseeable future and that eventually they will be able to dramatically increase margins and turn a profit. Further, since Splunk is the only pure-play big data company, the stock has had an irrational run-up as the result of hype and speculation. We believe that the consensus is hoping for an acquisition of Splunk as a move for one of the bigger tech companies to enter this specific segment of the enterprise software market and protect itself from competition.

Our View:

We think Splunk’s current valuation is excessive at 22x TTM sales and that the prospects for the company are much lower than those hoped for by the consensus.

Target Market:

According to its IPO filing, Splunk operates in three main business segments: business intelligence, IT Operations, and Security Information & Event Management. According to IDC, the combined total size of those three markets is $32.4 Billion. However, based on our target market analysis, Splunk’s realizable target market is actually closer to $15 billion as a large portion of the market is very entrenched and it will be hard to capture significant market share in those segments. Splunk is trying to gain traction in several different market segments with its product, but these segments are largely dominated by some of the major tech companies (SAP, IBM, HP, etc). For instance, of the Business Intelligence segment, 60% is controlled by major tech companies. Additionally, in the IT Operations segment, 53.6% is controlled by major tech companies. We believe that Splunk will have major issues convincing Fortune 500 companies to use their product over a product from one of the major companies. Splunk has far fewer marketing and other resources in comparison to these companies and we think that despite their product being somewhat differentiated from competitors, there is a significant risk that a major tech company can begin directly competing with Splunk. Given that these major companies have such an abundance of resources (cash, engineering talent, marketing power, etc.) we think that they could out-compete Splunk if they went head-to-head. The break-down of the target market is below.

In our analysis, we assume Splunk can potentially capture 20% of the market not controlled by major tech companies. We used Salesforce as a comparable case where a small, but rapidly growing company is competing against large tech companies in the enterprise software space. Using the most recent numbers from IDC, Salesforce has a 9.5% market share, which represents 12.7% of the market not controlled by the major players. Salesforce is in a later-stage than Splunk, but it still has room to grow so we think 20% is a good estimate of the adjusted market share a company like Salesforce can capture in the long-run. As shown above, we think that assuming Splunk is able to achieve a 20% capture rate of the market that is actually available to them, their total potential revenue is roughly $3 billion. This of course assumes that Splunk is able to execute flawlessly and that their product gains some serious traction. Since Splunk is only operating at 185MM in revenues for its current fiscal year, it would take at least another 5-10 years for Splunk to actually reach sales in the range of 2-3 billion. Thus, in the very best case scenario, Splunk could be earning a few billion in revenues in 5-10 years. However, we think that it is far more likely that Splunk gets up to about 500-600MM in revenues and then struggles to continue growing further.

Growth Struggles:

Over the last several years, Splunk has had to increase its sales & marketing expenses at about the same rate as its revenue growth in order to obtain that revenue growth. As is explained in Splunk’s prospectus, the company faces a very long and challenging sales cycle and thus it needs a large marketing force and it has to offer very generous sales incentives (in the form of stock compensation) to its sales force. Over the past few years, YOY growth has declined significantly, from 89% in FY11 to 56% in FY13 using management’s guidance for the rest of FY13. We think that over the next few years Splunk will struggle to maintain growth for several reasons: a major tech company may enter the market if it proves lucrative, the industry is extremely fast-moving so big data may not turn out to be as promising as once thought, and the continued economic malaise will keep pressure on software pricing from Fortune 500 companies. In our view, Splunk’s product is not differentiated enough to prevent its competitors from gaining ground or a new entrant to the market. In regards to pricing, we think Splunk’s pricing model of charging customers per unit of data processed will not be sustainable in the future; since the quantity of data is increasing exponentially, we doubt companies will want to pay 2 or 3 times more for the same product. We think that Splunk is likely to move to some form of a tiered pricing plan with a fixed price for a certain bundle of data, or possibly a price proportional to the size of a company’s IT infrastructure. As an example, EventTracker, one of Splunk’s competitors in the SIEM space, charges customers per server. A table on EventTracker’s website shows a comparison against Splunk in terms of pricing: for 100 servers, EventTracker would cost about 34k, whereas Splunk could cost as much as 60k-120k (assuming 100mb of data/day and 200mn of data/day, respectively. See here http://www.eventtracker.com/wp-content/uploads/2011/07/Splunk-Comparison-Final.pdf for the full comparison). Thus, we believe Splunk will eventually be forced to switch to a pricing model that is not tied directly to the quantity of data analyzed by their software.

Many that are bullish on Splunk seem to think Splunk could be bought out by SAP or Oracle, or a similar company at a significant premium. For this reason, we analyzed several recent acquisitions in which a big tech company acquired a rapidly growing competitor that was operating at a run-rate of several hundred million dollars of revenue.  Rightnow, a provider of CRM software, was purchased by Oracle for $1.5 billion in 2011, at a multiple of 7.5x TTM sales. SuccessFactors, a provider of cloud-based human capital solutions, was purchased for $3.4 billion by SAP, at a multiple of 10.5x TTM sales. Taleo, a cloud-based talent management company, was purchased for $1.9 billion, at a multiple of 6.1x TTM sales. Although these companies are not in the same specific segment as Splunk, we think they make good comparisons because in all three cases a major tech company made a defensive move to acquire a rapidly expanding competitor. Using these comparable multiples, and given our belief that Splunk could start to face difficulties expanding, we think that an acquirer would probably pay 6-8x TTM sales for Splunk. We believe that even if a deal did occur, it would not happen until Splunk had at least 300MM in revenues. Based on our estimates, Splunk will have revenues of 314.5MM in FY 15. Using multiples of 6x, and 8x TTM sales, Splunk would be valued at 1887MM, and 2516MM, respectively. Using the fully diluted share count of 116 MM, this would value Splunk at $16.27 and $21.69, respectively, at the end of Fiscal Year 2015. See below for a table with the acquisition prices and multiples used in our analysis.

Earnings Model:

As yet another way of valuing Splunk, we modeled the next few years of earnings results. We assumed that the company would start to see slower growth in FY 15 and would convert to a slower-growth, higher profitability strategy by FY 2016. Our assumptions include growth continuing but at a slower pace and that Splunk would be able to cut its Sales & Marketing expense in half. Using these assumptions, we estimate that Splunk will have fully diluted EPS of $0.73 in FY 16. Since most of Splunk’s smaller-sized, higher growth competitors are not public yet, we looked at several tech companies that have similar revenues and growth rates as Splunk will in FY 16 to estimate the P/E Splunk will trade at. The companies we used were Autodesk and Ansys, which trade at P/E’s of 25 and 36, respectively. Thus, we felt an appropriate, conservative multiple for Splunk would be 30, which values the company at $21.90 per share. Our sensitivity analysis and earnings model are below.

IPO Lock-Up Expiration:

One of our biggest catalysts for the revaluation of Splunk is the impending IPO lock-up expiration on October 18^th. The float is going to expand by over 100% as 52MM of the 95MM undiluted shares outstanding will be available to be sold after the lock-up expires. In fact, we think that one of the main reasons Splunk has performed so well since its IPO is because it is in a trendy market and because the float is small relative to the total number of shares outstanding. Thus, due to Splunk’s limited volume of about 600k shares per day and its frequent use of buzz words such as big data and cloud the stock has risen significantly since its IPO due to high demand from investors chasing the next big thing. As was the case with Facebook and Zynga, many of these investors are willing to buy in at almost any price and do not much consider the actual value of the company. We think that the expiration of the lock-up could bring significant sales by the major VC investors as profit-taking since the stock has performed so well. Two of the major VC investors, Sevin Rosen Fund and Ignition, own a combined 22MM shares. The coming flood of shares could cause Splunk’s valuation to collapse relatively quickly. In light of other recent lock-up expirations such as Facebook, Zynga, and Groupon, we think Splunk could fall by as much a 20-25 percent just as an immediate result of the lock-up expiration.

Stock-Based Compensation Expenses and Share Dilution:

Splunk compensates its sales force largely through stock-based compensation in the form of equity and option grants. In their non-GAAP earnings, the only major difference is that Splunk excludes stock-based compensation expenses. They claim that since these expenses are non-cash expenses they should not count in the earnings report. Essentially, the company tries to hide its significant marketing expenses because they are in the form of stock and not cash. This is a clear accounting gimmick as the company is diluting shareholders instead of simply paying the sales team in cash. Once the company is profitable, these outstanding employee stock grants will need to be factored in as the CFO mentioned on the recent Q2 earnings call. This represents a share dilution of over 20%, and counting. Because of this additional dilution, for our earnings model and acquisition analysis, we used the fully-diluted share count since these grants will be exercised in those scenarios.

Summary:

We think that Splunk is grossly overvalued and should probably trade in the mid teens. Splunk’s growth prospects are much worse than the market is pricing in and it is unlikely to be acquired by a major tech company given its already rich valuation. The coming expiration of the IPO lock-up agreement will cause Splunk’s price to sales multiple of 20x to fall to a more reasonable, yet still high, multiple of around 8-10x. This would value Splunk at between $15.60 and $20 (using the undiluted share count). We have a target price of $15 for Splunk and our timeframe is 1-3 years. We were able to find a borrow for this stock so we don’t think there will be any issues executing this trade.

1)      Expiration of the IPO lock-up agreement on 10/15/12. This will free up 52MM of the 95MM shares outstanding.

2)      Failure of Splunk to reach consensus growth expectations in any quarter.

3)      One of the major tech companies announces a new product offering that directly competes with Splunk’s main product.