Investment notes: Splunk - analogies to Adobe and Microsoft
Investment notes
Disclaimer: The below does not constitute investment advice. Please do your own research or obtain your own advice. The views presented are my own. I do not own Splunk shares at the current time, but am watching them closely. I will update this disclosure if I buy the stock.
Overview
Founded in 2003 Splunk (SPLK 0.00%↑) and IPO’d in 2012, Splunk is the market leader in providing full stack logging, APM, observability and security solutions. Splunk’s technology can ingest data (from various disparate sources within a company’s tech stack) to observe and respond to cyber security and IT infrastructure incidents.
Investment Thesis and what the market is missing
The opportunity to invest in Splunk has been driven by a combination of market and company specific factors. My thesis is driven by five key legs that I think the market is missing:
High quality platform, with strong technology: Splunk is foundational and deeply integrated with its customers technology stacks. It’s underlying technology (schema on the fly) is differentiated to the approach taken by its peers. It has consciously developed its product road map (internal innovation and via acquisition) to continually meet customer needs. In particular, I feel comfortable that Splunk has developed its product (via R&D and acquisition) to provide a fulsome high cardinality observability solution. The company serves 95%+ of the Fortune 100 and has a customer base of over 20k companies.
Analogies to Microsoft and Adobe with respect to business model transition: Similar to what Microsoft (MSFT 0.00%↑) and Adobe (ADBE 0.00%↑) went through, Splunk is undertaking a transition in its business model from a perpetual license model to the cloud and subscription one. While not everyone successfully navigates this transition, my diligence suggests that Splunk will make it. Microsoft and Adobe are both companies that were able to successfully make the transition from perpetual to a cloud subscription business model, resulting in better unit economics, customer metrics, growth and larger TAM’s. It’s pattern recognition, and we’ve seen this before. In my view, the market is myopic, and patience will be rewarded.
The opportunity to become a fully integrated player, taking wallet share from pure play competitors: I think the market will converge on one or two key players that offer a fully integrated solution. Splunk has the opportunity to be one of the few players with a fully integrated cloud based approach that covers various point solutions. A single software stack makes Splunk more resilient, efficient, and easier to roll out.
Aligned with two high quality Private Equity sponsors - Based on public disclosures Splunk has attracted investment from Silver Lake and Hellman and Friedman, at different times with different structures. Silver Lake invested $1bn as a convertible note in June 2021 with a $160 strike price. The note bears a nominal interest rate of 0.75%, and Silver Lake Chairman and Managing Partner, Kenneth Ho, joined the board as part of that transaction. Hellman and Friedman recently lodged a filing indicating they acquired 7.9% of common equity. These are both high quality PE sponsors, and given the strike price on the convertable note and the fact that Hellman are Friedman are in the common (so equivalent to most shareholder), I think investors are reasonably well aligned with both sponsors. As part of Silver Lake’s investment, the board authorized a $1bn buyback of stock on market to counter dilution from future conversion of the note, highlighting strong capital allocation principles. Interestingly Splunk recently agreed to a standstill agreement with Hellman and Friedman for 6 months, and provide certain confidential information.
Short term noise in the public markets creating the opportunity: The combination of market specific factors (recent precipitous decline in valuations) and company factors including confusing company disclosures, earnings misses, unexpected CEO (and now CFO) departure, and recent guidance downgrade has created the opportunity to invest at a compelling valuation. My view is that these are all transient in nature, and over time Splunk will regain the trust of the market and be re rated.
Does the valuation make sense?
Yes. There are a couple of ways to look at the valuation. While the market remains volatile, Splunk currently trades at an EV of approximately $15.5bn, which is around 4.2x management guided FY23 ARR. Another way would be to consider the cloud business only, which is currently around $1.8bn of ARR . Applying a similar valuation to Datadog, which expects to grow at ~38% NTM and is trading at 15.6x NTM revenues on the cloud business only would yield a valuation of around $23.6bn. Either way, the valuation makes sense.
How might Splunk be worth 5x?
Simplistically (not accounting for dilution, cash generated, etc), ARR compounds at 20% for the next 5 years, approaching ~$8bn (vs $3.3bn today). Assuming Splunk trades at similar levels to Adobe ~7.5x NTM revenues, this would suggest a market cap at around ~$70bn vs ~$13bn today.
Investment Merits
Deeply integrated and mission critical to customer’s technology stack - Splunk’s product is highly differentiated, foundational and deeply integrated into its customers technology stacks. Its platform approach means that customers can avoid vendor sprawl and gain synergies by using Splunk over point solutions, which I think will be the case as the economic downturn continues (CTO’s and CFO’s are going to be looking to manage vendor relationships, and negotiate scale discounts).
Large and growing end market - According to IDC estimates, Splunk is chasing a TAM of ~$50bn across its various product offerings, which has grown rapidly from ~$40bn in 2020.
Durable growth with large and growing cloud business - Splunk’s cloud business is currently a $1.5bn ARR business which grew at 55% yoy. Today Cloud ARR makes up ~45% of total ARR.
Strong financial profile at an attractive valuation - For this financial year, management has guided that it will make $3.65bn ARR, including $1.8bn of cloud ARR, with total gross margins of 78% ( 67% for Cloud business) and generating $400m of free cash flow. The company is expected to be a rule of 38 company by the end of the financial year and currently trades at 4.8x FY23 ARR.
New CEO with a proven public market track record - Splunk announced Gary Steele as CEO. Steele founded, listed, and grew Proof Point to a ~$12bn company.
Investment Risks
Highly competitive environment - Splunk competes against various point and platform solutions.
Challenging transition in business model - The transition from a perpetual license model to subscription / Cloud is complex and challenging and is not guaranteed (not everyone makes it). This risk is heightened for Splunk (vs Adobe and Microsoft) given the observability space is highly competitive. In order for Splunk to become an enduring company, it will need to make this transition successfully, and maintain a high quality product offering.
Macro headwinds have hindered cloud momentum - In its most recent quarterly report, management reduced guidance on cloudbased IRR citing macro economic headwinds. Specifically, management noted that customers were delaying cloud migrations given the current economic condition.
Poor historical execution - Splunk has reported a number of earnings misses and downgrades in the last two years suggesting some concern on the business’s ability to execute. Additionally, historical customer feedback has indicated concerns on an inconsistent pricing model
Product
Splunk’s product provides customers with the ability to ingest, collect, index and search disparate data sources regardless of format or size. The technology supporting the platform (schema on the fly) is unique relative to its peers, which is highly scalable while still being able to provide a level of flexibility to larger customers with huge amounts of log and metadata. The company offers functionality with various use cases across Security, Analytics, IT Operations, Observability and Monitoring. Given the various point solutions serving the above mentioned use cases, Splunk has the opportunity to be one of the few players with a fully integrated cloud based approach that covers various point solutions. Such a product is highly valuable to an IT buyer not just from a cost perspective, but also creates efficiencies from an integration and time perspective (fewer vendors to manage).
Market and competitive environment
According to management, Splunk is chasing a TAM of $100bn+ across its various product offerings, which has grown rapidly from ~$80bn in 2020. My research (cross checking various use cases with IDC data) suggests the market size is closer to $50bn, growing high single / low double digits. Either way, the TAM is large and growing. Growth in the market is driven by a number of secular tailwinds including digital transitions and increased data volumes. Splunk competes with many players across its various use cases including (but not limited to) Elastic, Datadog and Appdynamics. My view is the market is large enough with plenty of runway for multiple players to co-exist.
Understanding the transition to the cloud
A key part of the thesis is the business model transition Splunk is undertaking. Splunk stopped selling perpetual licenses in 2019 and has since only offered customers term or cloud based subscription products. The company has made strong progress in this transition, with about 45% of total ARR now cloud based.
Similar to what Adobe in particular (but also Microsoft) experienced, my view is that market continues to either not value or understand the opportunity that is available to Splunk to transition its large on prem customer install base to a subscription based offering. In the case of the companies mentioned above, post transitions the companies were able to deliver stronger growth and underlying unit economics, as well as larger TAM’s.
While Splunk has made strong process in this transition (from ~13% of total revenues in FY18 to ~45% today), management did note in its most recent quarterly call (where it revised down its cloud based ARR revenue expectations for the year) that macro conditions had slowed down its cloud transition progress. In Q2, Cloud revenues slowed down relative to Q1 (59% you growth vs 66%), and RPO bookings also declined from 32% to 17%, which management noted was driven by contracts with shorter duration and lower contracts. From the earnings call, it would appear that the current macro environment is resulting in customers delaying their migration to the cloud (i.e. continuing with their on premise license for longer) and longer sales cycles. Overall I still think that the long term thesis remains intact, as customers at some point are going to need to pull the trigger and move off the on premise solution, but there is some risk is they don’t choose Splunk.
Financials /Unit economics
Splunk has grown strongly since FY19, however, did see a decline in revenues in FY21 as the company saw a number of its higher upfront perpetual sales convert to lower upfront but higher LTV subscription contracts.
I present key financial and unit economic metrics below. Splunk is well capitalised and generally exhibits strong unit economics.
Thoughts on management and culture
The unexpected departure of former CEO, Doug Merritt, led to the appointment of Gary Steele. Prior to Splunk, Steele founded Proofpoint in 2002 which he took public in 2012 at a valuation of $385m. Under his leadership, he grew the company substantially before engineering its sale to private equity firm Thoma Bravo last year for $12.3bn. While Gary has yet to prove himself at Splunk, he is a proven successor with a strong track record in public markets. Additionally, Glassdoor reviews indicate a 95% approval rate, suggesting he has been well received across the organization.
Culturally reviews on Glassdoor are largely positive for a company that is almost 20 years old. Key pain points mainly focus on the transition to the cloud and overall growth in the company. Overall 79% of respondents would recommend Splunk to a friend with a 4.1 star rating.
Conclusion
Splunk is a highly strategic asset undertaking a business model transition that the market is either under appreciating or not understanding. The combination of market specific and company factors has created the opportunity to invest at a compelling valuation. I see Splunk as a company with the strong potential to compound capital at 20- 25% over the next 5 years. Absent new negative information, I expect to initiate a position in the next 12 months.