Splunk [SPLK] Conference call transcript for 2021 q2
2021-08-25 21:58:17
Fiscal: 2022 q2
Operator: Hello, thank you for standing by. And welcome to the Splunk Inc. Second Quarter 2022 Financial Results Conference Call. At this time, all participants are in a listen-only mode. After the speaker presentation, there will be a question-and-answer session. Please be advised that today's conference is being recorded . I would now like to hand the conference over to your speaker today, Ken Tinsley. Please go ahead.
Ken Tinsley: Great. Thank you, operator, and good afternoon. With me on the call today are Doug Merritt and Jason Child. After market closed today, we issued a press release which is posted on our Investor Relations website along with supplemental material. This conference call is being broadcast live via webcast. And following the call, an audio replay will be available on the website. On today's call, we will be making forward-looking statements, including financial guidance and expectations, such as our forecast for our third quarter and our fiscal year 2022 as well as future expectations of revenue mix, renewals, duration, RPO growth, cloud growth, bookings, gross margin and operating cash flow, as well as trends in our markets and our business and our expectations regarding our acquisitions, products, technology, strategy, customers, demand and markets. These statements are based on our assumptions as to the macroeconomic environment in which we will be operating and reflect our best judgment based on factors currently known to us and actual events or results may differ materially. Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today the information presented during this call may not contain current or accurate information. We will also discuss non-GAAP financial measures, which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website. So with that, let me turn it over to Doug.
Doug Merritt : Thanks, Ken, and good afternoon, everyone. Our team delivered another very strong quarter, with Cloud ARR growing 72% our 10th consecutive quarter of 70% plus growth. Over the last year, we've also doubled the number of customers with Cloud ARR by more than $1 million. And our Cloud dollar-based net retention rate remains best-in-class at 129%. These results speak to the high strategic value we delivered to the world's largest and most dynamic organizations. Our Q2 outperformance was also broad-based, with each of our major geographic regions exceeding plan, and validating that customers globally are relying on Splunk and our market-leading data platform and cloud-based capabilities. Splunk offers the most comprehensive data platform in the market today, powering our customer security, IT and DevOps teams. We are 100% focused on enabling them to make sense of and act on their log, metric and trace data to achieve the outcomes that matters most to them. We're also helping organizations rapidly migrate to the cloud, sticking more effectively and securely serve their own customers. We brought together the best cloud experts in the market to do this, while evolving our platform and customer-facing teams to serve our customers multi-cloud and hybrid worlds. When we talk about Splunk's supporting multi-class deployments, we're enabling deep and native visibility across any public cloud; AWS, Google Cloud, Microsoft Azure and others as well as any combination of those clouds. Our priority is for our customers to have the highest level of visibility across their organization's data as they can serve their own customers effectively and securely. And when we talk about supporting any hybrid deployment, we're referring to helping customers at absolutely any stage of their transition to the cloud, whether they're still predominantly on-prem or all-in on the cloud or somewhere between. As transformation that cloud accelerates and data ingestion needs skyrocket, our customers have asked for more flexible pricing. That's why we introduced workload-based pricing nearly 2 years ago, allowing our customers to take action on even more of their data without any gates on the ingestion of that data. This quarter's results showed that our customers are increasingly favoring this pricing option. During Q2, more than 80% of net new cloud ARR was from workload-based pricing, up more than 3x from a year ago. And now more than 25% of our total cloud ARR is from customers utilizing workload-based pricing. And our customers are reaping the benefits. For example, after using Splunk on-prem for five years, a major North American-based services provider to the finance industry decided to begin to shift to Splunk Cloud and workload-based pricing in Q2. This shift was driven from expected infrastructure management savings of 75%, increased Splunk feature and capability of velocity and the ability to forgo a costly hardware refresh that have been planned for the next year. Also in Q2, one of India's top five banks decided to go all-in on Splunk Cloud and workload-based pricing. They are leading on the versatility of our pricing model making it central to their overall security and cloud transformation strategy. They're leveraging Splunk Cloud services to drive efficiency and visibility across their entire technological infrastructure, delivering a world-class making experience to their customers. By improving the efficiency of their operations, this customer expects to be better able to meet strict compliance requirements and reduce risk while taking advantage of Splunk Cloud's scalability to help accelerate their digital transformation. And workload pricing was a big factor in one of several competitor displacements during Q2. For example, a major North American financial services firm have grown tired of the billing surprises a competitor dropped on them every single month. This customer appreciated our flat, predictable and transparent pricing and turn to Splunk to monitor their workloads across multiple clouds. Both existing and new customers are embracing Splunk cloud. For example, one organization new to Splunk this past quarter was the Norwegian Labor and Welfare Administration, also known as NAV. NAV, one of Norway's largest public entities purchased the Splunk Cloud Platform to help optimize and secure the distribution of Norway's citizens of unemployment benefits, pensions and more that amount to one third of the national budget. NAV is on a rapid digital transformation journey and relies on Splunk as their trusted tech partner to trusted tech partner to accelerate their systems from on-premise to the cloud in the way that's flexible, scalable and compliant with Norway's central government regulations. Now let's turn to our product portfolio. In Q2, we launched our Splunk Observability, IT and security clouds, applying our evolved cloud platform and pricing to our customers' specific needs. During our last earnings call, I shared news of our launch of Splunk Observability Cloud, which brings together the world's best-in-class solutions for infrastructure monitoring, application performance monitoring, real user monitoring, synthetic monitoring, log investigation and incident response, giving IT and DevOps teams full stack visibility and context across any hybrid or multi-cloud environment. This integrated multi-faceted delivery enables some powerful capabilities and now comes for our customers. For example, with Splunk Observability Cloud, our customer Lenovo, reduced their mean time to resolution from 30 minutes to about 5, allowing you to maintain 100% uptime through Black Friday traffic, which was 300% higher than the previous year. When it comes to IT operations, we're delivering some of the most broad and robust services in the market through our IT cloud, which combines the power of end-to-end virtual service visibility and monitoring with next-generation stream-based infrastructure monitoring and dashboard generation, incident and event management and on-call distribution response capabilities. And Splunk was recently recognized for the value we're delivering to our IT customers. We earned Gartner's number 1 spot in the ITOM performance analysis market for 2020. We were also named a leader in AI-ops by MBIA and Research in Action, giving us independent validation that customers looking to modernize IT operations through advanced analytics and automation are increasingly turning to Splunk as a preferred solution provider. Turning to security. The cyber threat landscape continues to grow in attack frequency and complexity. And we are rapidly innovating so our customers remain agile to adapt to ever-evolving threats. We spent Q2 helping customers better protect themselves from new threats like the Kaseya REvil Ransomware attack and more. We also launched Splunk Security Cloud, a modern security operations platform that gives customers advanced security analytics, automated security operations and integrated threat intelligence on one comprehensive platform. Companies like the Environmental Systems Research Institute, Real Chemistry and Soriana are already benefiting from our Security Cloud pricing model using a common and predictable metric. In Q2, a leading health care services company and existing IT ops customer, invested in our new security clap as they built out their next-gen set. Their existing SIEM couldn't meet the technical requirements that a customer is looking for and that our security cloud could deliver. While their IT ops team owns a Splunk perpetual license, it is our ability to offer workload-based pricing for our security cloud that help this customer expand from IT ops into security with Splunk. We also won a significant eight-figure deal at one of the 5 largest banks in Latin America. Here, the customer is looking for a single solution for all of their machine data, security and advanced machine learning in a rapidly evolving cyberspace full of threats. Basic logging and security offerings from 2 of our competitors fell short of matching Splunk's breadth and depth of offerings delivered on one cohesive platform. With Splunk, this large enterprise is now collecting data once and using it for investigation, IT use cases and to protect their mission-critical assets including financial and confidential data. And last month, for the eight year in a row, Splunk continued to be a leader in the 2021 Gartner SIEM Metric Quadrant. Gartner also validates Splunk as number 1 in the SIEM performance analysis market for 2020. Additionally, we retained the number 1 spot in IDC's cyber analytics, intelligent response orchestration and Tier 2 SoC analytics market shares. On the partner front, we're seeing terrific progress as well. For example, Splunk has continued to work with AWS to release new offerings to provide a more curated experience for customers who have an AWS centric cloud adoption model. Announced in Q2, the new Splunk Security Analytics for AWS is a simplified security analytics solution designed for lean security teams. These offering leverages deep centralized visibility of AWS environments, accelerating threat protection, investigation and response capabilities for security teams who have fewer staff. Also, one of our long-term preferred managed service provider partners, Blue Voyant, recently announced the launch of their Blue Voyant modern SoC for Splunk Cloud platform. The platform is designed to empower customers to maximize our investment in Splunk Cloud through features such features such white glove and technical workshops, rapid onboarding in the Splunk Cloud and 24/7 managed detection response powered by Blue Voyant 24/7 managed SoC. And finally, we're excited to host over 15,000 Splunk customers and partners at our annual user conference in October, where we'll roll out new capabilities, our updated product and services road map and further celebrate the data ecosystem in the incredible ways that our customers are training data into doing. When it comes to innovative, on behalf of our customers over nearly 2 decades, we never rest. I'm so proud of the entire Splunk team for delivering another fantastic quarter. And I want to thank our customers and partners for inspiring us to better serve them every day. Thank you. And I'll turn it over to Jason for more on the quarter.
Jason Child: Thanks, Doug, and good afternoon, everyone. Thanks for joining us. Our execution in Q2 was very strong, with overall bookings well above plan. We ended with total ARR of $2.63 billion, up 37% year-over-year. Cloud ARR was $976 million, up 72% over last year. And we ended the quarter with 582 customers with total ARR greater than $1 million, up 47%. 234 of these customers had cloud ARR over $1 million double the year ago period. Our continued focus on customer cloud adoption drove nearly $100 million in net new cloud ARR and total net new ARR of $164 million. Recall that in prior periods, RPO bookings was skewed by shorter overall contract duration related to the pandemic as well as change in our field compensation plans. With these factors mostly normalized now, RPO bookings is becoming a better indicator of bookings momentum. And in Q2, total RPO bookings was $676 million, up 29% over last year. As I said last quarter, with a substantial base of previous perp to term conversions coming up for renewal in the second half of this year, we expect total RPO growth rates will continue to accelerate in Q3 and Q4. On the P&L. Q2 cloud revenue was $217 million, up 73% over last year reflecting acceleration of customer adoption of our cloud platform. Total revenues were $606 million in Q2, up 23% and are benefiting from a more normalized average year-over-year term contract durations. Professional services and education accounted for 8% of total revenues in the quarter. On margins, which are all non-GAAP. Cloud gross margin was 61% in Q2, up slightly from last year, with continued progress towards our expected exit rate approaching 70% this year and improving to 70% to 75% next year as we realize leverage from scale and elasticity of the platform. Total gross margin was 75%, down slightly on a year-over-year basis due to the greater proportion of revenue contribution coming from the cloud. Operating margin was negative 20% in Q2, significantly better than planned due to our bookings of top line outperformance. On the balance sheet, we ended Q2 with $2.5 billion in cash and investments reflecting net proceeds of $983 million from the Silver Lake convertible note issuance. As we previously announced, proceeds from that placement will be utilized for common stock repurchases. And during the quarter, we repurchased 1.65 million shares at an average price of $138.90. And the plan has continued into Q3. Turning to guidance. We continue to see a robust demand environment and customer engagement is excellent, especially for existing customers planning their hybrid deployments. We expect to surpass $1 billion of cloud ARR in Q3 as we continue our acceleration, reaching $1.1 billion to $1.11 billion and total ARR of between $2.8 billion and $2.825 billion. Looking towards the end of the year, we expect demand and bookings strength to continue and to end the year with cloud ARR between $1.305 billion and $1.33 billion and total ARR of $3.085 billion and $3.135 billion. On the income statement, the cloud transition will continue to drive variability in our revenue and operating margin results. In Q3, we expect total revenues of between $625 million and $650 million depending on cloud mix and the success of new programs to promote cloud adoption. Non-GAAP operating margin should be negative 15% to 20%. Full year total revenues should range between $2.53 billion and $2.6 billion with a non-GAAP operating margin of negative 14% to 17%. On cash flow, we will be lapping our change to annual billings in the second half, which we expect will drive a return to full year positive cash flow nearing $100 million. We expect to enter next fiscal year with our customer base fully normalized with the annual billings and cash collections driving a significant increase in OCF next year. In closing, we've outperformed nicely year-to-date and are set up for a strong back half of the year. The overall demand environment remains robust. And with our product and service innovations geared to push cloud adoption faster, we expect continued high growth. With that, let's open it up for questions.
Operator: Thank you. Our first question comes from Brent Thill with Jefferies. You may proceed with your question.
Brent Thill : Thanks. And Doug, maybe if you can just talk a little bit about the consumption by type. It looks like you had good upside on the license and term. And many are asking when we expect to see even a harder inflection on cloud? I'll start there, and I had a quick follow-up.
Doug Merritt : Thanks, Brent. We were really excited about the continued progress with workload-based pricing. 80% plus net new cloud ARR was workload, 25% now of all Cloud ARR is workload-based. So I think that program -- when you talk to customers that have moved to cloud and have abandoned infrastructure-based -- sorry, index-based pricing and moved to infrastructure. If you're aligned with everything I'm hearing, you'll hear a lot of enthusiasm from customers. It was a stronger term quarter than we thought. And that really comes back to the craziness of the transformation, why ARR is such an important metric. And we were thrilled that we got some big TCV term deals in this quarter. We're honored to help a customer, whether they manage it themselves or we manage it for them. But that definitely skewed up term a bit, including term duration because they are multiyear contracts. But overall, the trajectory remains the same. Super strong cloud growth, more and more of the overall base going ratable, more and more of the overall base going workloads/infrastructure-based on the pricing piece. And we continue to stay super focused on that through Q3 and Q4 and beyond.
Brent Thill : And Jason, real quickly just on the buyback, good to see that, obviously is picking up. Should we expect kind of an even pickup in that buyback throughout the quarters, or any way you can help us understand how that's going to progress?
Doug Merritt : I would just say, we took advantage of the share price. And we were aggressive buyers in the last quarter. As indicated, I think, what, about $250 million or so that we bought back in the quarter. There were more purchases, I'd say ongoing in Q3. Don't really have an update of when we're going to finalize. So I'd just say stay tuned.
Brent Thill : Great. Thanks.
Doug Merritt : Thanks, Brent.
Jason Child: Thanks, Brent.
Operator: Thank you. Our next question comes from Raimo Lenschow with Barclays. You may proceed with your question.
Raimo Lenschow : Hey, thank you. I'll start with one for Jason and one for Doug. Jason, like it's been a while since you kind of started talking about annual guidance. Seeing that coming back obviously, like a very to -- at least to me, a very strong signal that visibility is increasing as you're coming out the other end on the transformation. Is that kind of the right way to think about it? Just kind of maybe talk to that a little bit, what gives you that extra confidence now?
Jason Child: Yeah. So thanks, Raimo. I would say, first, we always had planned with this transformation. There's kind of a lag of -- as we move to cloud, it takes we knew it's going to take roughly a year from last year's cloud bookings to kind of show up in this year's kind of GAAP numbers in terms of RPO and CRPO and all the various kind of derivative metrics. And I think maybe Q2 was maybe a quarter early in terms of seeing some of the rebound. I mean, you saw RPO bookings at plus 29% this quarter after being, I think it was only 5% positive last quarter. And it was negative I think, every quarter last year. So I think as we start to see more momentum in a lot of those other metrics, which I do expect, as I said on the scripted portion of the call. That certainly, along with really a pretty strong purchasing environment, we have a great pipeline. We've got all the indicators look good. I did talk about some of the cloud programs that we put in place this quarter. So I think the combination of those factors is what gives us more confidence going into the second half.
Raimo Lenschow : Okay, perfect. And then one for you, Doug. If I think about that consumption pricing that you put in that is so like by the customers now. How do you think that will feed through into the installed base? Do I kind of need to think about it like every time someone comes up for renewal, they will do that. Are you going to try to push it intra-renewal? How do I have to think about that evolution within the client base? Thank you.
Doug Merritt : Good question, Raimo. So for net news, it's default. Any net new cloud customers, default for the sales force to focus on workflow-based pricing. Customer success is a number 1 company priority. We really stay focused on that. So we don't want too strong on our customer into workload-based pricing, but every ounce of data that we've collected, and we now have got a big body of data continues to a point that's better for the customer, gives them a significantly wider aperture to play with data without worrying about the volume of data, brings more people to the overall platform, makes these solutions more palatable for them. So stay tuned. There's a lot of interesting things that the combination of Shawn and Teresa and some of the additional people we've been focused on, bringing on board and listening to have in play for the course of this year to make sure that we keep making this the right choice for customers and increasing the volume of customers that are switching away from the data ingest model.
Raimo Lenschow : Perfect. Congratulations. Thank you.
Doug Merritt : Thank you.
Jason Child: Thanks, Raimo.
Operator: Thank you. Our next question comes from Matt Hedberg with RBC Capital Markets. You may proceed with your question.
Matt Hedberg : Hi, guys. Thanks for taking my questions. Congrats on the results first of all. Doug, I want to start with you. It's been a few months since the Silver Lake investment. But I'm curious if you could talk a little bit about what that means to sort of the strategy? And really where you're at in this cloud transition? And just how that benefits the kind of the investment thesis?
Doug Merritt : Sure, Matt. So as we actually had our first interim board meeting where Ken participated. And it's been great to out of the Board. I think the overall perspective that we get from Silver Lake. They've watched a few of these transformations in the past. They've got a broad-based large tech-oriented companies that they invest in. So a lot of good compares that are definitely helping us in some areas on how are we approaching the transformation, how are we collapsing our metrics and measurements. The core for me on top of that and for the rest of the team, was the bar -- the high bar that I think some of the Silver's Lake stats. They're pretty effective and savvy at getting effective returns for themselves and they're limited. And the deep due diligence that we had to go through to get that investment, I think was very -- it was purposeful on our part. We're going through transformation is tough. There's a lot of opinions out there about Splunk, and adding someone as an insider, who is part of that investor community and is top tier. From an investor perspective, we felt was another support that there's light at the end of this transformation tunnel that it's a very positive light. And as we just talked through on guidance, and we're now focused on $3 billion plus ARR by the end of this year, north of $1.3 billion in ARR for our Cloud business at continued really enviable growth rate. So excited about the support and help of Silver Lake and Ken and Lee Wittlinger, who is assisting Ken and providing and looking forward to continue momentum on this transformation.
Matt Hedberg : That's great. And then just a quick one for Jason. The $3 billion ARR target is great. I guess from your perspective, when we're coming out of this transition and we're leaning more cloud, how do you think you get more to leverage in the sales force? To me, it feels like there's a great opportunity to see even more leverage there as we progress through the year? So just kind of thoughts on how that might transpire.
Jason Child: Yeah. I think that's absolutely right. The leverage in the model right now is, at least as measured by operating profit is certainly negative because of the 606 impacts of moving from term to cloud. We will see those recover. In the near term, you're going to see the leverage in cash flow. And so as we said, we'll have approximately $100 million of cash flow this year. And then next year, we'll have a full year of collections since we were lapping that upfront invoicing to now annual invoicing, which we did 2 years ago. And so next year, you'll see a full year return of strong cash flow. So I do expect to see the cash leverage really start to come back next year. I think on an operating margin basis, it will take a little longer. And that's really just dependent on revenue recognition treatment. Specifically to sales, if you go and look at the dollar kind of per ARR from the sales team, we're actually seeing really strong double-digit growth. I do expect that to increase. Certainly, in cloud where we do have DBNRR of 129%. That is one of the best indicators that I think we're going to have really, really strong leverage. And certainly, we're hiring reps at a rate that's less than the DBNRR rate. So that obviously will turn into the leverage going forward.
Matt Hedberg : Thanks a lot, guys.
Jason Child: Thanks, Matt.
Operator: Thank you. Our next question comes from Keith Weiss with Morgan Stanley. You may proceed with your questions.
Matt Wilson : Hi, it's Matt Wilson on for Keith Weiss. Thank you for taking my question. If I could dig a little bit more into the cloud transition, the annual cloud percentage of total software bookings was 51% this quarter, which was roughly flat from FY '21, after a couple of years of solid gains. Can you kind of help us understand what's going on here? Has there been any change in customers' willingness to move to the cloud? Or any color there would be helpful.
Doug Merritt : I think for this quarter, it was more the performance of term than anything cloud-related. We saw cloud ARR grow at 72% revenue overall in cloud, 73%. So our view especially given the ARR size of the business now, those as really, really unique and enviable growth rates. That said, as Jason mentioned in his remarks, Teresa had begun to use her experience with 10-plus years of getting people to understand the benefits of cloud through AWS. And to put in place a couple of programs, some internally-facing, some customer-facing that could continue to help customers and our teams and partners understand the benefits of cloud. So we're still very confident that we will end the year at a 60% or 60% plus cloud mix. And anything we do to accelerate that, we are focused on making sure that happens.
Matt Wilson : Great. That was helpful. And one more, if I may. You're seeing really great progress in large deals and customers over $1 million. Can you kind of just talk generally about the progress upmarket that you're seeing and the success there?
Doug Merritt : Getting near 250 cloud customers at $1 million-plus a year and almost 600 overall. That -- we're really proud of those numbers. I think a chunk of that is, we are the only unified platform and comprehensive set of solutions that with high features and capability ties together security teams, infrastructure management, IT teams, DevOps and ApDev teams. They're really, really different groups. They're different backgrounds, different skills, different metrics. They don't always love and hug each other, but they've got to work together if we want this digital transformation to actually continue to progress the way that we all wanted to. So I think we're seeing increasing understanding and cross-sell between those groups. And then as we've talked about and by workload is so important as far as the transformation, the volume of data continues to expand. Now that we're in cloud, we're moving away from data volume, that's great. But more volume means more opportunities to find needles in haystack, more opportunities on different bits to monitor and predict around and that all results in expansion within those accounts, which is why I think we've been very consistent on a apples-to-apples cloud DBNRR compare of 129, 130, 131 for those numbers.
Matt Wilson : Great. Thank you very much.
Doug Merritt : Thank you,
Operator: Thank you. Our next question comes from Brad Sills with Bank of America. You may proceed with your question.
Brad Sills : Great. Thanks guys for taking my questions. And congratulations on a nice quarter. I wanted to ask about early reception to the latest release that has made a lot of progress for integration of SignalFx on mission into that Observability suite. What are you seeing there from customers and in terms of willingness to expand into those other use cases from core logging that Splunk's so successful and known for?
Doug Merritt : Really good and important question. So my excitement about Observability is also kind of countered with this term becoming a super overloaded term. I think it's in danger of being the next AI or a client server or where it almost becomes meaningless because it's such a broad topic area. Within our Durability suite, we've got infrastructure monitoring, application performance monitoring, real user monitoring, synthetic monitoring, log investigation, incident response. So it's a really comprehensive offering. What we have seen is bringing the depth and capability across that really broad suite is important to customers. But what they want is going to vary based on where they are on their movement from a last generation static of apps to a next generation, highly fluid, a femoral cloud-based set of apps. So our belief and why we've invested so strongly in a comprehensive nature of the suite is they ultimately need all those capabilities across eventually IT security and AppDev. Right now, the bulk of it is DevOps and AppDev, and that's a little bit more APM and that can really use oriented than IT, where it's a little bit more infrastructure monitoring-oriented. Our strength is we play in both camps, both the last generation, monitoring and visibility as well as what's going on within the cloud deployments that these guys have.
Brad Sills : Great. Thanks so much, Doug. And one more, if I may, please. With the success you're seeing in workload-based pricing and the data velocity that's enabling less friction and bringing more data in. What's your confidence in the ability to sustain that cloud dollar-based net retention level of 129? Very strong levels, it would seem that with that trend in place that it could be a very long runway if that workload-based pricing is doing what it's supposed to do, which is bring in more data volumes that you're seeing already? Thank you so much.
Doug Merritt : Really good observation. The interesting part and why the shift to workload has been I think so important on behalf of our customers, is data volume is a factor, but it's not the factor. I've said in a couple of calls that the cost of finding, moving and indexing data, so it's available is -- it's a cost. But that's not the big driver. The big driver is what are you going to do with that data? And that's where the curation of the data, the cube queries and interrogation of that data come into play. And whether it's hitting our index whether it's allowing our heterogeneous search to go after data directly within S3 or other storage vehicles, whether it's something on the stream, that our solutions are continuously -- are increasingly relying on, workload neutralizes that factor. We've heard complaints ever of, hey, I've got -- I'd love to play with Netflow data, but it's huge. It's hundreds of terabytes per day. And I don't want to pay for that, but I want to at least have it if I can play with it. Now with workload-based pricing, you get that opportunity, very cheap to push that either into our index or in something like S3. And then when you need it, it's there so that you can rewind time, do the needle in the haystack work that you need to. Because ultimately, every one of these systems will go down and will all likely face some type of a breach, you need to be able to investigate and understand what happened. So I think it really aligns much more clearly with what customers have been asking for.
Brad Sills : That’s great to hear. Thanks so much, Doug.
Operator: Thank you. Our next question comes from Karl Kierstead with UBS. You may proceed with your questions.
Karl Keirstead : Thanks, so much. Maybe 2 for Jason. Hey, Jason. If I take your 4Q ARR number of the high end $3.1 billion, $3.5 billion. And I assume a relatively slow decel as Splunk scales. I can arrive at a view that you're actually only going to miss your original $4.5 billion ARR target by, let's say 2 quarters. I just wanted to ask, is that way off the mark? And when do you think you'd be in a position to offer visibility on the ARR number beyond fiscal '22?
Jason Child: First, I think your math is reasonable. And yeah, I think that's -- it's reasonable. And I think the -- when we're in a position to talk about long-term targets sometime in the near future. I would say -- I haven't finalized yet. It's either it would be at earliest, late this year or maybe sometime early next year. The things that we're trying to figure out are -- we've got a bunch of new cloud programs as we talked about, that we just put in place this quarter. We've got 2 great leaders from AWS that have been here a couple of months. And then obviously we've got a bunch of new cloud and a bunch of new products and services that have been released. And so to really be able to kind of distill all those things and come up with a kind of a high fidelity view on what the next few years look like will take us a little bit of time. But hopefully what you're seeing is really strong fundamental growth. And so as you pointed out, really not that far off from where our old long-term targets were. But we'll definitely give you a better view at some point. The first step was to give full year guidance, and that's what we've done now. And I'll be certainly working on trying to come up with some firm long-term targets sometime in the near future.
Karl Keirstead : Yeah, that makes sense, Jason. I think we all appreciate that. So, thank you. And then my follow-up is just on your comment that RPO bookings should accelerate in 3Q-4Q. I just want to clarify from a base of 29% that you just did, does that acceleration assume any duration increase. And then if you can also clarify, I think you said on the last call that CRPO should be in the low-20s in the next several quarters. Do you still feel good about that? Thank you.
Jason Child: On CRPO, I think that's certainly a reasonable range and nothing has changed and something in the 20s certainly is reasonable. Just remember our CRPO, it does get distorted if cloud mix bounces around. For example, if you have a higher term percentage, you will book 3 years of revenue, and that shows up all in current RPO because it's part of revenue. And the change in RPO is going to -- while it may be -- our current RPO may be high, current RPO bookings may not be. So that metric still can bounce around based on cloud mix. Total RPO bookings really it was only affected by duration. In fact, if you look at the 29% that we put up this quarter, you can see that our duration was actually down 2.5 months year-on-year. And so if you duration adjust it, you'd be something closer to 34%. So we are not assuming duration extension to help with RPO bookings in the future. Instead, we are lapping a -- Q3 was a tough quarter last year. And so that certainly makes for an easier comp as well as, as the guidance implies, we do see a strong fundamental for the second half of the year.
Karl Keirstead : Excellent. Thanks a lot. It's nice to see Splunk coming back with a good quarter. Appreciate it very much.
Jason Child: Thank you. Appreciate that a lot.
Operator: Thank you. Our next question comes from Kirk Materne with Evercore ISI. You may proceed with your question.
Kirk Materne: Yeah, thanks very much. And congrats on a nice quarter. Jason -- or I don't know if Doug, you want to take this. But you both sound very upbeat about the pipeline heading into the back half of the year. Can you just talk a little bit about sort of what your confidence is sort of based upon? I think one of the challenges maybe earlier this year was you're not knowing how some of the renewal deals were going to look in terms of the construction of the deal itself, whether it's cloud or -- and what kind of capacity people are going to be buying in front -- sort of in front of -- or what level of capacity they're going to buy in the next re-up? Are you just seeing more normalization and sort of buying patterns? I was just wondering if you're going to pack that a little bit more as you obviously both sound very upbeat as we go into the back half of the year. Thanks.
Doug Merritt : So we certainly took away a lot of lessons from midyear last year. That, I think as we've talked about, has pretty dramatically impacted the level of visibility and some of the process steps and other pieces that help us get higher confidence in qualification, and wherever possible can at least highlight unexpected surprises with a little bit more scrutiny when something is ever included in the forecast or not. I think the theme around that. So that all is good housekeeping internally from a very unique moment in time, the height of the pandemic and a very unique impact within Splunk. Externally, what we've seen is consistently -- I think from the in the headlights of Q2 and Q3, where people were companies and leaders were really trying to digest and understand what's going on with this pandemic, what's going to happen with the economy? What's going to happen with my balance sheet, what's going to happen in my income statements? I think it was taken over. And I've heard it with virtually every company that's reported the past 2 quarters, including us, is if you're not online and if you're not a leader online, you're going to be in trouble. There's no strong likelihood that life is going to go back to normal anytime soon. So you've got to have an effective digital presence. I think that with continued confidence in access to capital and the stock market buoyancy certainly helps all of us in some ways, has had a very consistent set of purchasing behavior, I think, over the past few quarters. We're not expecting that to radically change over Q3-Q4. But the forecast we put forward is really based more less on our guesstimates about the macro environment, the microenvironment. And more the interrogation and inspection of our customer base, the health and quality of the forecast, our assumptions on cloud or non-cloud movement. So a little bit more of a bottoms-up set of activity that's driving our Q3-Q4 outlook.
Jason Child: The only thing I would add is that, obviously DBNR continues to hold steady at 129, which at our size is certainly something that we feel really good about. That continues to hold. And then second, I would say the renewal pipeline in the second half of the year is always -- it's always been expected that it's going to continue to grow into Q3 and then peak in Q4. And because those high retention rates, that does definitely provide confidence.
Kirk Materne: That’s super helpful. Thanks guys.
Operator: Thank you. Your next question comes from Keith Bachman with BMO. You may proceed with your question.
Keith Bachman : Hi, thank you very much. Two questions. Maybe the first one for Doug or Jason, but I wanted to see if you could talk about customer churn. And the way I'd frame the question is customer churn over the last 12 months versus the previous 12 months. And part of the reason I'm asking the question, there still is an investor perception out there about Splunk losing some share. And so I wanted to ask it in the context of customer churn? And then I have a follow-up, please.
Doug Merritt : Despite what you guys reading here, that's not of we're experiencing. We continue with very consistent, just straight renewal rates on both cloud and term. And obviously very consistent DBNRR. Again, that is a cloud-based TTM number. If we factored in the overall corporate stance, it's higher than that because that does take in consideration some of the impacts of the uplift from term of the cloud, and we want to get that out. So we'd have an apples-to-apples comparison. We have been talking about for a while, our health within the top 10 accounts, the Fortune 100 accounts. That's consistent, 92 of the 100 are still -- are Splunk customers. I'm really intent on making sure those last eight become customers as well. I'd confuse whether or not, but there's reasons for each one of them. The number of customers with greater than $1 million, right, close to 250 cloud customers, close to 600 overall customers within the company. So, what we see and what we hear from customers definitely is different than some of the action I get from you and some of your peers that different analyst firms and others are driving up.
Keith Bachman : Okay. Jason, I wanted to follow-up with you on cloud gross margins. Relatively flat the last 3 quarters, call it lower than total gross margin. So what's the movement you think in cloud gross margins as we look out over the next couple of quarters? And how should that make us think about the ability to expand your total gross margins if we -- or excuse me, total operating margins as we think about the impact of cloud gross margins as we look into FY '22? Thank you.
Jason Child: Sure. If you heard my comments in the prepared remarks, we're expecting continued improvement in cloud gross margin through the back half of this year with an exit rate approaching 70%. And then actually, went on to say that we expect next year to be 70% to 75%. So the reason why it's been kind of stuck for the past few quarters is there's kind of 2 different aspects. There's the Splunk kind of cloud gross margin on the core Splunk cloud offering, which has been steadily increasing, but it's been offset by some lower gross margin in the Observability Suite where we worked over the past couple of quarters to integrate some of the acquisitions and really kind of pull things together. And so that work was really largely complete in May. And now you'll start to see us focus on overall elasticity, which basically means paying for what you need when you need it. And that allows us -- that will allow us to make sure that we're improving our gross margins over the back half of this year and on into next year.
Keith Bachman : Okay. Perfect. Many thanks, Jason.
Jason Child: You bet.
Doug Merritt : Thank you.
Operator: Thank you. Our next question comes from Rob Owens with Piper Sandler. You may proceed with your question.
Rob Owens : Great. Thank you for taking my question. Just one from me, was curious on the security front relative to competition in the SIEM market, and particularly from the XDR players that hold that they're starting to take share from SIEMs. So curious what you're seeing there, relative to your offering and the demand picture? Thanks.
Doug Merritt : I think like we've seen with the rest of the security market, we did see an uptick in overall security activity as far as purchasing activity expansion from Q1 to Q2. So it's a really healthy quarter for security, as we'd all expect given the intensity of what's happening there. Again, kind of a lot of work to say that XDR is replacing SIEM right now. I don't even know how that's logical given the limited data sets they capture and the relative infancy of their offerings right now relative to a SIEM. From an EDR perspective, I get it. But a SIEM is very different than that. So it's -- what we stay focused on is progression of our Security suite. We had a really big 4-5 months. We've got a full cloud-based suite now of SOAR, analytics, Security analytics, SIEM. We're thrilled to add the threat intelligence platform the offering, a lot of feature velocity that was delivered and a lot more that we're focused on for our user conference in October. Needs stock teams have are pretty important right now. And we stay very focused on that.
Rob Owens : Wonderful. Thanks for the color.
Doug Merritt : You bet. Thanks, Rob.
Operator: Thank you. And our last question comes from Erik Suppiger with JMP Securities. You may proceed with your question.
Erik Suppiger : Yeah, thanks for taking the question. On the competitive front, I'm curious if there's been any update on the Observability front? Any change there? And then secondly, can you just comment on the timing for the Silver Lake investment? What was the nature of pulling the trigger when you did?
Doug Merritt : Sure. So the durability and comparative overall, very consistent win loss rates this quarter versus last quarter. And the Observability, we had actually a slight uptick in our performance versus competitors. We recognize that we are a newer entrant in the Durability and there's a lot of work we have to do to develop the strength there that we have in Security and IT ops. So that is a super, super strong focus area for us and remains really exciting as far as the opportunity. And our understanding of our unique differentiations and how to compete effectively. For Silver lake, you never really can put time these things. You've got to have both parties that are open and interested. I think the stars have moon lined up where we -- it was appropriate for Silver Lake to consider this. And we were thrilled that they were interested. Super tight process is the only conversation that we focused on. And the value that we've already seen that Ken and Lee, the firm are adding has been tangible. And we're excited about how the partnership that's developing and how they can continue to help us stay focused through transformation and make sure that we have the same upside that we've seen in the Adobes and the Autodesks and a handful of others that have successfully navigated these waters as they come on the other end.
Erik Suppiger : Very good. Thank you.
Doug Merritt : Thanks, Erik.
Operator: Thank you. I would now like to turn the call back over to Doug Meritt for any further remarks.
Doug Merritt : All right. Thanks, Josh. I just want to thank everyone for joining us today. I know there's a lot of new announcements coming out of earnings calls today. I want to step back and reiterate how proud I am at the entire Splunk team. And the impressive execution that we drove across every region. It was really, really nice to see the company come together under the leadership of our theater leaders, our capable theater leaders to deliver that end result. The passion, grit and resilience to delivery has been absolutely key through a really challenging 18 months as we're all dealing with lots of variables. I'll just reaffirm one more time that we're the most comprehensive data platform in the market. Our customers are benefiting from the rich range of capabilities from the underlying platform as well as the solutions on top. We continue to see strong momentum in how our customers are migrating to our cloud services, how they're adopting and updating the pricing options that we're putting in front of them. Data is the oil. It is the oxygen that these companies need, and we're excited to be there to help them with that. I also want to highlight that now, we are to continue to be able to attract and hire the best cloud and tech talent on the planet. They're bringing the right expertise to help us capture this massive and growing market opportunity that we're staring at and working hard to make sure we capture effectively. And I'm more confident than ever in our position and growth outlook. So thank you again. Have a great evening. And I look forward to talking to you all in another quarter.
Operator: Thank you. This concludes today's conference call. Thank you for participating. You may now disconnect.
