© 2024 Alpha Spread Limited. All Rights Reserved.
www.alphaspread.com is not operated by a broker, a dealer, or a registered investment adviser. Under no circumstances does any information posted on www.alphaspread.com represent a recommendation to buy or sell a security. The information on this site, and in its related newsletters, is not intended to be, nor does it constitute, investment advice or recommendations. The information on this site is in no way guaranteed for completeness, accuracy or in any other way. In no event shall Alpha Spread Limited be liable to any member, guest or third party for any damages of any kind arising out of the use of any content or other material published or available on www.alphaspread.com, or relating to the use of, or inability to use, www.alphaspread.com or any content, including, without limitation, any investment losses, lost profits, lost opportunity, special, incidental, indirect, consequential or punitive damages. Past performance is a poor indicator of future performance.
You don't have any saved screeners yet
Intrinsic Value is all-important and is the only logical way to evaluate the relative attractiveness of investments and businesses.
Intrinsic Value is all-important and is the only logical way to evaluate the relative attractiveness of investments and businesses.
Good day, ladies and gentlemen, and welcome to the Splunk Incorporated First Quarter 2019 Financial Results Conference Call. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session, and instructions will follow at that time. [Operator Instructions] As a reminder, this conference is being recorded.
I would now like to introduce your host for today’s conference, Mr. Ken Tinsley, Corporate Treasurer and Vice President of Investor Relations. Sir, you may begin.
Great. Thank you, Bruce, and good afternoon, everyone. Thanks for joining me. With me on the call are Doug Merritt and Dave Conte. We issued a press release after close of market today and it is posted on our website. Additionally, this conference call is being broadcast live via webcast and following the call an audio replay will be available on the website.
On this call, we will be making forward-looking statements, including financial guidance and expectations, including our forecast for our second quarter and full-year of fiscal 2019 and our expectations for fiscal 2020. Trends and expectations regarding partners, customers, markets, strategies and deal size as well as trends and expectations regarding revenue mix, planned investments and trends in our operating model resulting from our investments and our expectations regarding our acquisitions, products and technologies.
These statements reflect our best judgment based on factors currently known to us and actual events or results may differ materially. Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements.
These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.
We will also discuss non-GAAP financial measures, which are not prepared in accordance with Generally Accepted Accounting Principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.
So with that, let me turn it over to Doug.
Thank you, Ken. Hello, everyone, and welcome to the call. Q1 was a solid start to the year in terms of both field execution and product innovation. We delivered $312 million in total revenue, up 37% over last year. We also announced a series of product developments that expand the capabilities of our portfolio. At the recent RSA Conference, I had the opportunity to meet with many of our customers and partners.
What came out of our discussions is a continued validation of Splunk’s role as a nerve center for security, and the importance that our platform and solutions bring to CSOs, CIOs and their teams through Splunk’s ability to leverage their data no matter where it's sitting, in the cloud, on-prem or both and simultaneously use that data to solve a variety of use cases in Security, ITOps and DevOps.
Throughout Q1, we received overwhelmingly positive feedback on the Phantom acquisition, which will enable us to leverage orchestration and automation capabilities in security and other use cases like IT. For example, imagine Splunk’s IT Service Intelligence predicting an outage. It can trigger Phantom to provision or reboot troublesome servers and avoid an issue or use one of our many integration such as automatically issuing a ServiceNow ticket.
Building an analytics-based, self-healing cloud is just one of the many possibilities. Our customer, who recently began using Phantom, has changed healthcare. They turn to Phantom to help them address integration needs related to their recent joint venture, which doubled the Company's servers and networks. As a result, they expect a large increase in the amount of security data they ingest. Phantom will allow Change Healthcare to contain costs by orchestrating playbooks and automating many steps at the investigation process without requiring significantly new resources.
We will continue to lean forward on our build/buy/partner strategy to deliver value to our customers and accelerate our innovation. I am pleased with how the integration is going and we are excited to welcome Oliver, Sourabh and the Phantom team as they moved into our Bay Area offices last month. As I covered at a recent Analyst Day, we are early in a large and growing market, when you consider the significant growth in the amount of data being generated and Splunk is all about helping customer to extract more meaningful insights from that data.
During Q1, we rolled out new products and solutions that are helping us to address our market opportunity. We announced a limited availability release at Splunk Industrial Asset Intelligence, our first packaged IoT solution targeted at industrial companies. Our solution delivers real-time monitoring and analytics to help automation and process engineers identify and diagnose issues, enabling improved availability and performance of their operating environments.
We've been working with beta customers, including Shaw Industries, who adopted Splunk to implement real-time factory floor analytics, giving them insights in uptime, quality and production metrics. For ITOps, we introduced Splunk Insights for Infrastructure as our new monitoring solution that runs automated investigations on IT infrastructure. With SII, customers are able to surface trends and identify root cause faster and easier. This new solution formally known as Project Waitomo, collects and analyzes both metrics and logs, making monitoring and troubleshooting seamless.
Systems administrators and DevOp teams can get up and running in minutes and can start monitoring smaller environments for free. When they are ready to increase usage, we chose storage capacity as our pricing metric to make it easy to expand and to align with our customer’s value. We also expanded artificial intelligence capabilities across our product portfolio. With the latest release of Splunk ITSI, customers can use AI to help prevent outages through predictive analysis of service health.
Splunk UBA features new machine learning models, enabling customers to identify and address time-sensitive security problems and insider threats more quickly. The latest release of Splunk Cloud and Splunk Enterprise added enhancements to our free Machine Learning Toolkit, making it easier to view, control, evaluate and monitor the status of ML experiments. One thing that's becoming increasingly apparent is that Splunk and just about any other technology in the ecosystem provides better results for our customers.
As I've highlighted a number of times, we're intent on providing an open data platform for our customers. We've expanded this area, adding integration with Open Source and Cloud Native Technologies, including Apache Kafka, Kubernetes and Docker. With these releases, Splunk customers are better positioned to make sense of their data, to search, to monitor and alert on that data in real-time and to predict future IT security and business outcomes.
It's increasingly apparent that Splunk's platform is the best solution to enable customers to harness these data sets to gain operational intelligence by asking different questions the same data across multiple use cases. In Q1, we saw a continued momentum with our customers, both in our Splunk platform and aligned with our market group focus. Starting with ITOps and App Delivery.
Wins in the quarter include the University of North Carolina, Charlotte, who is already a Splunk security customer and upgraded their use of Splunk Enterprise to improve uptime for their student information and learning management systems; and a large federal agency who expanded their use of Splunk Enterprise and ITSI to improve the stability and availability of its online citizen services portal.
With Splunk, this agency can easily correlate data from multiple data centers, both on premises and in the cloud in order to provide a single cohesive view of their complex environment.
Moving to security, where we continue to help our customers migrate from a structured legacy SIM to an analytics-based approach. Notable security wins include the University of Alabama Birmingham Medical Center, who expanded their use of Splunk ES to replace a legacy SIM.
Splunk will sit of the heart of the hospital's new security operation center to better identify and defend against threats; and Relativity, who's a new Splunk Cloud and ES customer. The eDiscovery software company chose Splunk to better identify security threats and address customer needs to scale.
Highlighting a handful of customers who went all in and [indiscernible] on Splunk as their machine data platform. On G, a multinational utility company based in France, is expanding their use of Splunk Enterprise to include new use cases to monitor On G's own IoT applications and end-to-end monitoring of the IT stack. This enriches numerous existing use cases, including security, AWS Cloud Monitoring and DevOps.
Telco and Internet services provider, 3 UK, expanded their use of Splunk Enterprise to support a major business transformation project designed to establish the company as the best loved brand by customers and people. Splunk will help with GDPR compliance, streamline operations and improve customer satisfaction.
We also saw our cloud business continue its momentum. A sampling of our cloud wins in the quarter include Canadian insurance company, The Cooperators, an existing Splunk on-prem customer, who chose Splunk Cloud to further improve their security posture and IT infrastructure.
The UK’s Together Financial Services replaced their legacy SIM with Splunk Cloud and ES because of Splunk's ability to be a single platform across security and IT. Thanks to our partner, Summerford, for their help on this win.
Australia's La Trobe University purchased Splunk Cloud to advance their smart campus vision and gain a better understanding of their facilities utilization, including lecture theaters, libraries, student cafes and restaurants.
Moving on to the ecosystem. We expanded our relationship with Accenture, bringing Splunk, among other technologies, into the Accenture cybersecurity engine. By seamlessly integrating leading security software solutions on a single cloud-based platform, their solution gives organizations the power to detect, investigate and respond more quickly and effectively to cyber threats. This is another example of our partner ecosystem adopting Splunk technologies and underscores our continued leadership in the SIM market.
We're also continuing to build on our partnership with AWS, recently announcing Splunk Insights for AWS Cloud Monitoring in a pay-as-you-go model on AWS marketplace. This gives our customers even more flexibility on how they use Splunk and AWS together. And our AWS app, which helps customers get more value from their AWS data, remains one of the most popular and top downloaded apps on Splunk base.
As you know, customer success is our number one company priority, and that focus has helped us to fill a great team and culture. I am very happy that Splunk was again named one of the Best Places to Work in the Bay Area for the 11th consecutive year as well as similar awards in Europe and Asia. These recognitions are a testament to our people and are testament to our people and their commitment to our customers and our partners.
In summary, it was a solid quarter and start to a fiscal 2019. I'm proud of the entire Splunk team. We're uniquely positioned to capture the tremendous opportunity in front of us and we are pursuing it aggressively. We are early in our journey, and we are investing for scale and growth.
We're delivering high value to our customers. We're expanding their adoption of Splunk as their platform for machine data analytics, both on-prem and in the cloud. Again, thanks to all of our customers and partners and thanks to all of our awesome Splunkers.
Now let’s turn the call over to our CFO, Dave Conte.
All right. Thank you, Doug. Good afternoon, everyone. Thanks for joining the call. I'm pleased to report a strong first quarter and solid start to the year. First quarter revenues were $312 million, a 37% increase over Q1 of last year on a 606 basis both years.
Cloud revenue was $34 million, up 89% over the last year. Q1 software revenues, which is the total of license and cloud, were $173 million, up 43%. Education and professional services represented 10% of total revenues. International operations contributed 27% of total Q1 revenues and we added over 460 new customers and recorded nearly 406-figure orders.
Historically, we provided the six-figure order metrics as an indicator of our growing adoption within our customer base. Related to this we've also provided greater than seven-figure orders annually as an indication of our number one initiative of customer success.
Starting with this report going forward, we will provide orders greater than $1 million instead of 100,000. To that end, in Q1 we recorded 43-orders of 1 million or more which compared to 35 in Q1 of last year. Overall, our growing product suite, complemented by increased awareness and compelling value prop continue to drive broad and large scale adoption.
Now turning to profitability and other results, which are all non-GAAP and on a 606 basis including all the comparables. Q1 overall gross margin was 79%, comparable on a year-over-year basis. Operating loss was $14.7 million, representing a margin of negative 4.7% slightly better than our outlook driven by our solid topline performance.
Net loss was $9.4 million or $0.07 per share using a weighted average share count of 143.5 million shares. Operating cash flow for Q1 was $77 million, while free cash flow was $74 million. We also ended the period with almost $1 billion in cash and investments which is after the cash payment for the Phantom acquisition.
Now turning to the balance sheet, again note that all values have been recast in their entirety following our full retrospective adoption of 606. Accordingly, you can now see the impact of the accounting change on deferred revenues which we detailed at our Analyst Meeting in March.
As a further heads up starting with our 10Q with our first quarter results you will see a new disclosure required by 606 called remaining performance obligation or RPO. Simply RPO is the aggregate of deferred revenue and backlog and totaled $765 million as of April 30. And this compares to about $800 million as of January 31.
Now turning to guidance. We expect Q2 revenues of between $356 million and $358 million and non-GAAP operating margin of a positive 2%. For the full-year we're now expecting total revenues of approximately $1.645 billion, up from $1.625 billion and we maintain our non-GAAP op margin target of 11.5%. It’s important to note that the expense run rate we assume with the Phantom acquisition is incorporated into our margin guidance.
Since we expect to be non-GAAP profitable for the remaining quarters this year, please remember to use a fully diluted weighted average share count for your EPS calculations. As we continue to scale and drive toward our goal of $2 billion of revenue in fiscal 2020 were eager to expand the capabilities of our service partners.
Specifically we have focused important parts of our customer success organization to our partner enablement and the expansion of their service delivery capabilities. This is a critical element toward ensuring our customers have the best resources available to aid them on their Splunk adoption journey.
To that end, we expect that over time, partners will deliver more services and take the related revenue directly versus our own delivery teams and revenue on our P&L. We all know this trade is not new in our industry and it helps drive increased value that customers derive from their data.
Now historically PS and EDU revenues have ranged between 5% and 10% of total revenues. The shift to greater partner service delivery will result in our PS and EDU revenue moving away from the top end of this range over time.
In closing, we are off to a good start for the year. Our product investments are driving customer success and our field expansion is enhancing our overall execution capability. Our strategy is working well and we continue to fuel the pace of adoption as we drive to make Splunk the standard for machine data analytics.
Thanks much for the time and interest. With that, we will open it up for questions.
[Operator Instructions] And our first question comes from the line of Kash Rangan from Bank of America Merrill Lynch. Your line is now open.
Hi. Thank you very much guys. Congratulations on a phenomenal top end quarter. Can you just, Dave, recap for us how we should be looking at billings in the context of the shift towards ASC 606? That's number one. When I do some quick math, it looks like the backlog which is the aggregate of deferred revenue, I guess [indiscernible] numbers $765 million that you disclosed right, [backlog and] deferred revenue, it looks like the backlog grew substantially. Can you just talk more about that?
And then finally, the Street is calculating your billings to be whatever it is reported, I know it's less and less relevant, but just to set the record straight if you had ASC 606 comparable billings from a year earlier, what would that growth rate have looked like from an apples-to-apples basis? Thank you so much and congrats again.
Yes. Thanks Kash. And I do miss the [indiscernible] part of your question, so will get that for next quarter.
I'll come back.
We will come back to that. So there were probably three or four questions roped into that, so let me see if I can knock them down. First of all you're right. We no longer provide billings guidance and we suspended that along with many others in the software industry because under 606 it’s just a less relevant metric.
You have revenue that is being recognized in the income statement that actually is unbilled. And when we think about what’s a better or perhaps more relevant metric that we will be providing it's really the remaining performance obligation.
So we really wanted to establish a baseline to say listen Q1, it was $765 million that compares after our seasonally strongest fourth quarter with about $800 million. We're not guiding to that yet, but we think over the balance of the year as 606 becomes – as we all become more acclimated to how that flows through the financial statements, we'll be able to look at that metric in terms of better guide, in terms of instead of billings. I think the bigger impact you are seeing, well what would it have been if it was 605.
So I’ll just declare for all the questions that are coming, 605 is end of life. It has been fully retired. We worked extremely hard to provide four years of comparability under 606 and everything that we talk about is 606.
With that probably one of the elements just to remember, we are consciously moving more and more to subscription and last year we were at roughly just about 50% subscription and we have an objective to accelerate to get to 65%. And when you look at overall yield in the financial statements, whether it's the balance sheet, whether it's the income statement or even the IPO disclosure, the impact of having greater and greater amounts of subscription is tied directly to the duration of those contracts.
We've been moving towards – it's been two years on average for the quarter, it was slightly above that, but without duration being equal to 36 months, you're going to have a different overall contract value yields that fits into all of those categories.
So that's very consistent with the guidance that I provided on the fourth quarter around how to think about cash flow for fiscal 2019 as we move more and more to subscription you have, the duration is shorter, but also customers have the tendency to be billed annually. So really if you're thinking about – well how do I understand billings under 605 versus 606, forget 605, billings isn’t the right metric, but we're really moving from 50% to 65% subscription.
Dave I’m finding way through the summertime blues.
Thank you.
Thank you for the explanation.
Okay, Kash. You bet. Thank you.
Thanks, Kash.
And our next question comes from the line of Michael Turits from Raymond James. Your line is now open.
Hey, guys. Two questions, one, I’d like to come back to the old topic of pricing and whether or not there's any change in the way in which some of your competitors are being aggressive or not on pricing and push back from if there is any – is that’s changed in any way from customers and whether or not there's any plans to adapt pricing plans in anyway to that? And then I have an accounting question.
Hey, Michael, so as we decided with something like Splunk Insights for Infrastructure and as we [indiscernible] we're continuing to roll out different solutions and/or different cuts of Splunk that have different pricing metrics. The SII app is based on amount of stored data, not ingested data, Ransomware is based on number of monitored users or number of active users.
Our strategy is to continue to offer different capabilities and make sure that we're pricing them in a way that makes sense based on the value delivered and what other categories of tools that are similar how they price as well.
What I have seen with customers is a) better awareness of term options, enterprise, adoption options, and other mechanisms we rollout that help our customers feel like they’ve got predictive spend with Splunk instead of some of the challenges that we've all talked about on [indiscernible] that could be at the mercy of bursts of data and what that could do to any type of quarterly spend with Splunk.
So I've seen a continued slow decrease in some of the energy around pricing. But I think that would be accelerated as we continue to have more packaged offerings and different cuts of Splunk that get away from some of the more variable fees that would have to come in through Splunk.
Okay, and then Dave, accounting question. I'm pretty sure this comes out in the Q, but – and it may have been buried somewhere I didn’t see, a lot of numbers out there but do we have the deferred revenue number for 1Q 2018, so the year-ago on a 606 basis – because we are on 606 now?
We do not have a balance sheet out of 1Q as of fiscal 2018, no.
Okay. Do we get that in the Q?
I don't think that comes in the Q. The Q is going to have the year-end balance sheet compared to the Q1 balance sheet.
Okay.
Similar to the table in the press release, yes.
Okay, all right guys. Thanks very much.
Thanks, Michael.
Thank you, Michael.
And our next question comes from the line of Phil Winslow from Wells Fargo. Your line is now open.
Yes, thanks guys for taking my questions. Congrats on a great start of the year. I just wanted to hone in on actually your comment, Dave, on just large deals this quarter. Obviously, you're seeing just a continued trend there, not just this quarter, but over the past couple of years. So a question about you and Doug and just in terms of just a focus on, call it, larger deals through existing customers versus net new customers. Obviously, you've got to focus on both. But can you just give us sort of an update on sort of where you think sort of the sales force is and balancing those because, obviously, it's getting very well on the big deal side.
When I look across the initiatives of the Company, there's two that are really important that actually fit into exactly the questions just asked. One is getting increased adoption across our accounts, and that's where you see ASPs go up, size of deals go up, and that's the whole land adopt expand renew type of motion within accounts.
And the other is higher transactional volume and higher focus on net new customers. As we've talked about, we are continuing to make a whole series of investments to ensure that we're moving that net new needle up. But we also do not want to lose our focus on the overall traction, excitement and commitment that customers have as we're seeing more and more value from Splunk within their current accounts.
So it’s – they're literally initiative number two and number three. They’re almost like 2.1 and 2.2 because they're virtually tied as far as overall importance on the cohort and business models that we're driving.
Yes, hey Phil. It’s Dave. I think if you reckon back to a lot of the discussion we had at Analyst Day in March, both from a product delivery perspective, I'm sorry, the product capabilities delivery both on-prem and in the cloud and then all the work that Susan is doing, all of those tied together around the number one priority customer success. We see as you point out correctly large orders that are strong indications of adoption and how we're driving in that, but also how we’re deploying our resources to continue to grow the overall pool of customers. We laid out a mile marker of 20,000 by the end of fiscal 2020 and we’re tracking to that target.
Got it. Thanks guys.
Thanks Phil.
Thanks Phil.
And our next question is from the line of Raimo Lenschow from Barclays. Your line is open.
Thank you. Two questions for me. First one for Dave. Since you say RPO was the one I should track, and are you going to give us or what's the best way to look at it? Is that year-over-year number is the best way, I think conceptually I would say so, but then are you going to – I didn't hear that you talked about in Q1? Or should we just wait for Q2? And then the second question for Doug is on – if you run off your services a little bit more, I mean you were not very service heavy. Can you talk a little bit about the incentive structure partners have in terms of multiplier they are making on your revenue number, exactly ASP and it was like a four to six times multiply. What's the story for you and what’s the incentive on the partner side? Thank you.
Hi, Raimo, it’s Dave. Thank you for your question. And I think it's consistent with Michael and what's the balance sheet of a year ago under 606 which is a tremendous amount of work to get there as you can well imagine. I think the best way to think about it, we were conscious to try to give the sequential comparatives that really shows the seasonality and the impact on the RPO number. All I can ask is for some patience as this metric develops and matures over the balance of the year. I think we'll all collectively figure out the best way to interpret it, but today I think it’s sequentially.
And Raimo on the services and overall incentives for the sales force. As we've been talking about, we have, year-by-year, been continued to augment the commission plan so that perpetual is at least on par with and/or eventually, it has a triple plays versus term and cloud. And I think this year we made additional strides to ensure that our reps would be very interested in presenting term and cloud, so that we get the right type of movement and behavior that we're driving for our business model shift overall.
Services has a commission stream to it, but it's not something that we are emphasizing with reps. Our focus is on software revenue and software revenue growth and that's the core health of our business. What Dave talked through around the shifts we are making as far as trying to get our partners to continue to step up on services delivery. This goes back to both success and empowerment of our partner ecosystem and services is one of those core areas that they are very interested in focused on as well as coverage and reach.
How do we have more people that understand Splunk, no Splunk are telling the Splunk story and are working with us to drive customer success, but we've heard loud and clear from our partners and actually fits in with our focus on software revenue is let's continue to build and empower and educate customers on different implementation and success services, so that they can help us to create a balkanized accounts.
Okay. Perfect. Thank you and congrats from me as well.
Thanks Raimo.
Thanks Raimo.
And our next question comes from the line of Anne Meisner from Susquehanna. Your line is now open.
Hi. Thanks for taking my question. Doug, a quick one for you. I just wanted to circle back to last year's user conference. You unveiled the metrics functionality. And I'm just wondering if you can update us there and what kind of response you're seeing in the customer base and whether you're seeing sort of new use cases being enabled for that since I do believe it was something that customers were asking for.
Thanks Anne. Yes, it's not so much new use cases, although Splunk Insights for Infrastructure really leans on that metrics capability. Customers were deriving metrics by doing queries, which is very taxing on an infrastructure basis, to create schema on the read that would then do different aggregations, so they could actually get some type of a sampling across those metrics.
The rollout of the metrics store as part of the index and all the – both infrastructure decreasing costs as well as rapid increase in response time and capability was to make sure that you're using the technology for that use case that it was architected or driven to serve. So what we had seen is customers really wanted to monitor, detect and investigate from one framework and the metric index is moved to say you're doing that – let's hope you do that in a more elegant and more cost efficient and quicker response time basis.
What I think you’ll see in the coming 12 to 18 months is continued aggressive lean in on more alternatives to get even more real time, even more capable as far as size and results set by leveraging the data fabric, orientation of Splunk and the capabilities of a lot of different technologies that exist around us.
Thank you. Very helpful. And just a quick follow-up for Dave on the performance obligation. Thanks for disposing that. It looks like $139 million roughly is off balance sheet backlog, given the fact that you expect a trend toward annual invoicing. I assume that number, the off balance sheet backlog should then grow much faster than total backlog, is that a fair assumption?
I think the challenge on that Anne is, there's a difference between what is remaining performance obligation and what is invoiced? Again, on a term contract, the revenue can be on the face of the income statement even if the invoice hasn’t gone out. So the backlog isn’t purely unbilled amounts, its remaining performance to be performed i.e. additional revenue to be recognized, which is why it's a combination of deferred revenue and backlog.
I see. Okay, that explains. Great. Okay, thank you very much.
You got it.
Thanks Anne.
And our next question comes from the line of Alex Zukin from Piper Jaffray. Your line is now open.
Hi. This is Taylor Reiners on for Alex. Thanks for taking my question. I was wondering if you could give us an update around kind of the early cross-selling opportunities you've been seeing with Phantom and how you're looking at that ramping throughout the year. And then maybe any changes you plan to make to the Phantom sales organization over the next year? Thanks.
Thanks Taylor. It’s little bit early to really have enough of a bead on the cross-sell impact. What I definitively have seen is incredibly high level of interest, energy and excitement around what the orchestration automation capabilities of Phantom brings to the underlying Splunk platform as well as the overall security use cases.
We all see that security spending continues to increase the problems faced by anyone that's involved in cybersecurity continue to grow. And we already are the established leader in security analytics. We've been focused on with Phantom is adding to the orchestration and automation capabilities that we launched initially with the Adaptive Response Initiative, so that we can increase the learning and visibility into how the loop was closed when a key insight, driven by the analytics platform, is actually executed on behalf of our customers and that’s right, I think the customer base is responding to.
Got it. And then just a quick follow-up. I was wondering are you seeing any opportunity to extend Phantom's capabilities to the operation side of the House in terms of orchestration and automation?
Absolutely. The way I described Phantom is, there's two elements to what we're excited about. One is, all the security content that Phantom have focused on to ensure that there were effective playbooks in automation for security related incidents, and I'd put that more in the security market group content bucket, but the other piece which I think is equally or possibly even more exciting is the orchestration automation capabilities on the platform layer that any of our market groups, ITOA, IoT, business analytics, can leverage and are beginning to leverage. But just as importantly the hundreds of thousands of custom apps that our customers create, giving them the ability to tap into that as well.
Got it. Thanks again, and congrats on a great quarter.
Thanks Taylor.
Thanks.
And our next question comes from the line of Brian White from Monness, Crespi. Your line is open.
Great. I am wondering Dave if you could walk through a little bit on the second quarter operating margin. It looks a little bit lighter than I know that we're modeling and I think the Street, but you kept your annual operating margins. So is this simply the impact of integrating Phantom or is there something more?
Well, I think there is two elements Brian. You might recall, we spent a fair amount of time over the balance of the second half of last year and eight day talking about how the seasonality changes under ASC 606, both from a revenue and expense perspective.
And so I think what we've said is, most of that is Q1 and I think you've seen that impact. But it was really a change in the first half, second half. So that's one element. The second element is we did embed the expenses from Phantom for a full quarter into Q2. So it's really the combination.
Okay, great. And on Phantom, do you feel like this just strengthens your position in the security markets in the products that you have? Or does this really open up a new TAM for Splunk?
A little bit of both. The new TAM is not enormous at this point in time. It's an evolving category. This is an orchestration automation category. But there is meaningful value that customers are looking for and why I think that category overall has gotten a lot of excitement.
I think the core that we are looking at is what do you think about the full lifecycle of effective analytics, the final stage is being able to take action and understanding the efficacy and overall effectiveness of that set of actions so that you can take advantage of the insights that you've gotten from the other stages of that data pipeline.
And Phantom and [LIBOR] organic initiatives are part of the key to making sure we've got a strong fourth pillar on closing the loop, especially on more of an automated ML system driven approach while still integrating with the other technologies that need to do additional actions to ensure that our customer is protected in the security case or remediated in ITOps case or effectively manage in a IoT manufacturing for operations case.
Okay. And Just for Doug. Big picture, the Cambridge analytic fiasco, has that had an impact on your customers and how they're thinking about big data?
Hi, good question. This – hi, good question. The last two years have really had a lot of visibility, and GDPR has probably got more fans there in our world than Cambridge has. But people are definitely more and more aware of and thoughtful on the obligations that they have on protecting data.
Where I think Splunk really comes into play is we can provide a lot of visibility for organizations on what play is we can provide a lot of visibility for organizations on what is happening to their data as well as drawing insights out of that data for a better decision-making.
Okay, right. Thanks a lot. Congrats guys.
Thank you.
Thanks Brian.
And our next question comes from Fatima Boolani from UBS. Your line is now open.
Thanks for taking the question. Just wanted to revisit the professional services discussion that you had earlier, and I'm curious about the gross margin implication. Do you kind of pass up more business to partners? Should we expect a release in the margin on the gross margin line, and a couple of follow-ups, if I may?
Yes, hey Fatima, it’s Dave. I think the margin impact. Again, this is a longer-term trend where we're driving. In fact, as we utilize some of our customer success organization to enable partners, we'll probably – that standalone P&L may have a little bit like to it from a margin perspective.
But from an overall contribution to the bottom line, those impacts are going to be kind of de minimis, in my opinion. But we're really thinking about broad enablement, an ecosystem of partners, not just direct sellers that can engage with our customers to get more successful with the software. That's really strategically important to us. But from a margin perspective – I don't think there's enough math there to anticipate either a benefit or a detriment.
Fair enough. And maybe a question for Doug, In your prepared remarks, there's maybe more case studies an example of IT operations use cases this time around versus security that kind of takes the cake as we can drop prior calls. I'm curious on your perspective on where we are in terms of the scale, maturity and market awareness for your ITOps use cases, especially vis-à-vis security, which feels like it's more on cruise control?
Yes, [so ironic] because we started, as you guys know, in IT operations. And because of the urgency, boardroom visibility and all the other factors in and around security, that definitely has taken center stage, which were super, super happy about and obviously benefit from. But the needs within the broader ITOps, APT, DevOps, CloudOPS world continue to be challenging for organizations.
And I'm really excited about the roadmap that we have over the next 12 and 18 months that you'll see increasing drops around to help all the constituencies on that infrastructural side of life, from developers, all the way to IT operations, get better visibility, predictability, quality in a really turbulent landscape.
Cloud is, I think, only increased the complexity given the micro-services, the more ephemeral nature, the speed and often difficult visibility that, that comes with those types of deployments in addition to the pretty complex on-prem data centers that folks have to manage as well. Really, there's still.
That’s really helpful. If I think a quick one in for Dave. Dave, with respect to the $1 million that you're now going to provide every quarter, should we read that as coincident with higher EAA volumes that you're seeing? I know in the past, you've explicitly said that $1 million deals don't necessarily equate to EAA. But I'm curious if that relationship has changed or is changing? And that's it for me. Thank you.
Well, it's a fair question. I think the relationship is the same. It's important for everyone to come as Fatima, you appropriately point out, seven-figure transactions are not synonymous with EAAs and EAAs are a subset of those numbers. So that relationship isn't changing at this point.
Thanks Fatima. Bruce next question please.
And our next question comes from the line of Abhey Lamba from Mizuho Securities. Your line is open.
Yes, thank you. Dave, when you look at the net new customer relations in the quarter that was down year-over-year for the third consecutive quarter now. What's happening on that front? And how should we expect your investments in that area to payoff?
I think we've got a solid start to the year and we're really happy to be able to bring in 460 new customers. Why do we are focused on increasing that number is given the size of the TAM, we believe that we can and should be adding – seeing increase the number and adding even more in new customers. We have been making a number of investments across a multitude of areas in the company to make sure that we focus on and address this area. And I believe that we're on track to hit our target that we articulated 1-year and change ago by the end of FY 2020.
Got it and Doug, you mentioned about GDPR, can you tell us a little bit about how it helps you and when we should start seeing some benefits for that to flow in? That's if for me.
We are seeing more awareness that some of the compliance elements with GDPR come back to similar structures use cases capabilities that we've seen for lots of other monitoring and detection use cases. And obviously, security in ITOps, the two primary. But even something like our industrial asset intelligence app, that ultimately is grabbing a whole array of signals from centered equipment and parsing through those to try and flag alerts remediations, potential issues, predictive analytics.
So you can get in front of issues on the shop floor. GDPR and GDPR compliance has a lot of those same characteristics I've viewed as one of the thousands of use cases that Splunk could be applied to within an organization. We do have a, we call Splunk Essential, have a cookbook for how you would implement Splunk what kind of data sources you would go and grab and what kind of visualizations you should probably start with if you want to use Splunk to help you with GDPR compliance and visibility.
And so we're seeing more customers include a, hey, can you help me with GDPR set of questions, along with can you help me with ITOps? Can you help me with AppDev? Can you help me with security analytics? Or can help me with some of my customer intimacy or manufacturing use cases as we work to make people more aware of the multitude of use cases and benefits that Splunk can drive for customers.
Thank you.
Thanks Abhey.
And our next question comes from the line of Matt Hedberg from RBC Capital Markets. Your line is now open.
Thanks guys. Well done on the quarter. Doug, maybe starting with you. You guys are obviously doing well in ITOM and security, but also seems like IoT continues to percolate up as a nice sort of vertical driver. I guess, speaking along the lines of a broader vertical app strategy, how do you guys think about the cadence of building out incremental vertical apps that sit on the platform? I guess, I'm wondering, might we see at some point some applications graduate out of Splunkbase that you take in-house?
I mean, we definitely – I think we've been working on emphasizing more attractiveness in the ecosystem around Splunkbase. Okay, more people to understand the platform, participate, contribute, et cetera. And yes, we see steady growth in different solutions that exist on Splunkbase, still largely centered in security and IT, ITOps/AppDev. Our launch of industrial asset intelligence, while I'm excited about that solution, I think it adds a lot of value, my main emphasis is that we've been talking about how it can be used in IoT for so long. Let's put a beacon out there that I think is relatively horizontal.
There's a lot of industrial situations, I think, that can benefit from IAI. But let's really use it as a more defined example that hopefully inspires and instigates more people to think through additional use cases and solutions/apps that can be created in that IoT or business analytics space. The separate piece of how many of those do we want to own and control. And my view over the next three or four years is that if we continue to do things properly, we will increasingly come to minority as far as monetizable solutions around the Splunk platform. But for now, we're still relatively early in our journey and a lot of the work to get in these types of solutions done is coming from our team combined with third parties to help them understand how they attack these different problems.
Super helpful. Maybe a quick one for Dave. Maybe I missed this, but I think the last quarter, you talked about fiscal 2019 cloud billings. I think you said about $270 million in revenue or about $160 million. Did you guys update those after Q1?
No, we didn’t. The full-year guide for revenue for cloud for fiscal 2019 is $160 million.
That's what it was and that it remains unchanged at this point?
Correct.
And then billings also, I think you said $270 million last quarter?
That is what we provided last quarter, yes.
Okay. All right. Thanks guys.
Thank you.
And our next question comes from the line of Mark Moerdler from Bernstein Research. Your line is now open.
Thanks. Congratulations on the quarter and thanks for taking the question. I'm not sure if you gave this, but what was the mix between potential license and term licensing in the quarter? And then a follow-up.
Hey, it’s Dave. Yes, we used to provide mix as an annual guide and then a quarterly update. And instead of providing a quarterly trash about that mix, we said, look, we're going to just give you an annual target, which for this fiscal year is 65% up from just over 50% last fiscal year. So you didn't miss it. We're not providing it on a quarterly basis.
Okay. On the term the cloud contracts, can you give us a sense of what the average contract term length is? And maybe consider you've been giving that on more frequent basis, so that we can have a sense of how modeling as that term contracts obviously lengthen out and how we can think about the value of the term contracts and the cloud contracts to the licenses?
Sure. So for the first quarter, the overall contract duration between cloud and term was like 27, 28 months. That's been pretty consistent. It's up a little bit in the quarter, but I just remember, seasonality can be impactful in terms of that rate. What I mean by that is in our seasonally smallest quarter, a handful of orders can have an impact on duration more so than our fourth quarter. The first question around, what's the composition of the balance sheet and the old metric around billings, it is important to note, as we look to increase percentage of our business that is subscription i.e. term and cloud, that as long as duration is shorter than 36 months, those transactions are smaller, then what would be an equivalent perpetual plus one-year maintenance transaction.
Obviously, and then the only part that then goes with it is at some point, renewal on those terms, but it's probably too early for that?
Yes, certainly, with these growth rates, that's true.
Thank you, appreciate. Good luck.
Okay, thanks.
And our next question comes from the line of Kirk Materne from Evercore. Your line is now open.
Yes, thanks very much. Just one first for Doug, Doug, you touch on this a little bit early, but when we think about your partner ecosystem right now, it feels like the security sort of use case with a partner ecosystem is very, very strong. When we think about the big global SIIs, are they starting to try to think about other sort of use cases? Are you getting industry lead partners to come in and talk about use cases of Splunk either operational analytics, IoT? I’m just trying to get a sense if that partner ecosystem can start become a little bit boarder from a use case perspective?
Yes, that is - when I think about the market group leaders, security, ITOps and AppDev, business analytics, IoT, there's a handful of things that they are tasked with. One absolutely is deep domain knowledge and understanding of their segment.
The other is guidance of any type of solution that we are responsible for, Enterprise Security, UBA, ITSIs as examples, but the third is duration, development and overall corralling of the ecosystem with each one of those different areas.
And the IoT arena in particular, I think is going to continue to stand out as a segment that is much more dependent on partners than security or ITOps, given the much higher variety of vertical specific use cases and therefore, the need for people with deep domain expertise in the vertical as well as some degree of technology under data expertise.
We're definitely seeing, as we [indiscernible] that vertical, looks at the prioritized verticals and then start to talk to different partners in each one of those verticals. We're seeing a little bit were awareness and excitement on of whose Splunk is and why you they might want to pay attention to us.
I think the challenge that we see is a lot of the real, strong relationships and strong expertise is housed by people that don't have the brand names that we'd all be familiar with. So we keep leaning on the Accenture's and the Deloitte and Capgemini’s and others.
I mean those are important partners in this area. But I think they have to be augmented with specialty SIIs and ecosystem participants that really will help close the gap the last mile to effective delivery for those use cases.
And then a quick one for Dave, Dave, I know it gives you pretty good hiring period for your all. Are you guys sort of on track with what you wanted to add sort of just a net adds basis in the first quarter? And I assume, backing off to a pretty good start just based on I was expecting it to be a little bit more of our upside were flowing through, but I know you guys are investing pretty heavily this year?
No, hiring is actually really strong for us. It's really encouraging to see candidly as we have to continue to increase our capabilities both in product and of course, in the field. So I think from an organic perspective, hiring for the quarter was really strong. Of course, then we added in some headcount from the Phantom team so that the addition there, I think we ended the quarter with over 3,600 total employees globally.
So I’m actually – really encouraged by the rate of on boarding because putting some pressure on the G&A organization to make sure that we effectively onboard all those kinds of folks. But that's a good kind of pressure to have. So we're – yes, we really have a good start have a good start to the year in that regard. So thank you for that question.
Great, thanks guys.
Thanks Kirk.
And our next question comes from the line of Karl Keirstead from Deutsche Bank. Your line is now open.
Great. Yes, David, I’ve got two for you. One on Phantom and the other one on cash flow. On Phantom, David, what are you assuming as the 2Q revenue and deferred revenue impact of closing the Phantom deal? And then, secondly, on operating cash flow, super strong at $76 million. That was way above what we were thinking. And that represents about a quarter of your guide for operating cash flow for the full year. When I go back, Q1's normally like 16% to 18% of cash flow drops in Q1. So for it to jump to 25% tells either that something unusual happened, your $300 million guide is just too low or maybe this subscription mix shift is changing cash flow seasonality, but if you could pinpoint it, that will be great.
I agree, Karl. If I could pinpoint it, it would be great. Yes, the cash flow yield, as a percentage of revenue was obviously very strong. But it's really indicative of what was a tremendous performance by the company in the fourth quarter. So the collection capabilities that to be realized were off of that strength. If you then fast forward for the balance of the year, I will affirmatively reiterate our expectation for the year is for $300 million of operating cash flow. We'll have to monitor that as we progress through the year.
And of course, our bigger quarter is ahead of us. And the billing characteristics, the invoicing, I should say, characteristics of our customers is something that we're going to continue to measure and of course, update our own expectations as well as those that we said with you guys.
As it relates to the impact of Phantom on our financial statements, I would say the impact on deferred revenue and then any revenue that will be realizing is really de minimis, not even impactful in terms of how we've modified our adjustments or our internal outlook. The biggest impact, of course, is from an operating expense perspective as we parachute in almost 100 new employees at once.
Okay. Got it. Thanks for that David.
Thanks Karl. Appreciate it.
And our next question comes from the line of Steve Koenig from Wedbush Securities. Your line is open.
Hi, gentlemen. Hi, thanks for taking my question. Maybe one for Dave and one for Doug. Let's see. So Dave, I'd like your answer on the last questions maybe last. Maybe just big picture on the – if we think about the factors that can affect the 606 revenue, and they get really lumpy. You reported it up 37% year-on-year. Things like cloud mix and duration, which you've already addressed duration a little bit. But cloud mix and the shift to term, are you able to tell us did that affect the revenue comp in Q1 significantly either positively or negatively?
Well, as much as I don’t want to go back and the time machine, I think we were pretty transparent that we had some inconsistent performance in Q1 of last year, and that was reflected in our financial statements on a 605 basis. If you – and then once we go back and we recast prior year revenues, again, the seasonality effect is really evident because the change in revenue under the adoption of the new standard had a fairly impactful reduction in Q1 of last year.
So from a comparability perspective, we had some spots we didn't like in last year's quarter, but comparability wise, [pros and cons] those all played out. And that's why it was so important for us to do full retrospective, so that we can give you comparable results and try to cut through the differences in our delivery vehicles, i.e. perpetual term or cloud. So again, the growth rate of 37% reflects a comparable 606 basis where term cloud and perpetual all being treated the same way.
Okay. Great. Thanks Dave. So Doug, the one for you. I think you've – on the call, you've addressed most of the comments you made at the Analyst Day about the transformation initiatives inside the Company that are going on. Maybe the one thing I didn't hear as much about on this call is what you're looking to do around cloud? You mentioned things concerning ease-of-use, rapid updates of technology, et cetera. Are those currently reflected in the product? Are those features? Kind of maybe give us an update on your progress there – what you want to do in cloud?
Yes, it's an end. I mean, there's a lot of, I think, enhancements and lean that we've done and that we're always doing to try and decrease costs associated with Splunk, the usage of infrastructure, et cetera, increase the approachability. We've been injecting natural language processing in Splunk. There's a whole bunch of new visualizations and views, we got a product coming out in the future that will be much more targeted to casual business users and people that don't have any interest in ever learning any type of language. So we're attacking it constantly and from every angle.
What I see with cloud and why we've been talking hybrid for so long is the world right now is still, I think, is very binary and bipolar on cloud and on-prem. And we believe and see a very hybrid world. And my belief and prediction is baked into our product road map is that three to five years now, people stop talking so much about cloud.
That we better live on-prem, that we better live in the cloud, there's better on-prem and the cloud will be uniformly managed in more or less invisible and where they live and they lived where they need to live because of the use case. Yes, because of the loss of physics and any type of data governance or control that you want to have, et cetera. So what you'd see – where you'll see as we continue to drive releases is a continued blurring of the lines. I think [indiscernible] has done really good job of this as a living example that on-prem and cloud.
Got it. Great. Well thanks for the thoughtful answers. I appreciate it.
Thank you.
Thanks Steve.
And our next question comes from the line of Jesse Hulsing from Goldman Sachs. Your line is now open.
Yes. Thank you. Maybe the first one for Doug and then I have a quick follow-up for Dave. When you look at early users of the industrial app, how are data volumes trending versus what you see in security and operation? And just wondering, is there a potential for data volumes? And I guess, if you follow the deal sizes, we follow that to be bigger in order to relate itself?
There has been so much dialogue of the year on our data volume driven pricing. And what I talked earlier and what we'll continue to see is, different iterations and packaging of both underlying Splunk platform as well as different solutions that provide more options for customers that are not always data-driven. Right now, in the beta and limited availability release customers are – the way that you'll likely see this product to be framed is not on a data volume basis. I think the volumes can be much larger and it can be smaller depending on what we are automating and what the characteristics of the data sources look like.
But the value and the interfaces and the tech that's necessary, I think are all iterations of what we're doing today that our iterations are different than given the very different user profiles, capabilities, skills and data life scenarios of process engineers and more casual line of business users versus the much more technical security analysts and ITOps analysts that we traditionally have been addressing. So there's our road – a continued road map of capability, technology and release, and you'll see more and more options on pricing that will start to take the lens off of just data volume.
Yes. That makes sense. And then Dave, it seems like people have been trying to triangulate on the billings versus revenue thing for most of the call. I calculated 606 billings growth of 18%-ish and 606 revenue growth is in the high 30s. Is bookings growth closer to revenue growth of closer to billings growth? If you can answer that, I think that would be helpful for everyone. Thank you.
Yes. That’s a fair question. I’m not really sure how to answer in the right way. I think what's important is, over the balance of this year, as we all move towards what will become the standard pallet of disclosures under ASC 606. We will retire. I think everyone will retire billings.
That's why you felt it was important to give a baseline for the RPO disclosure of $765 million so that we can start to measure what is, I think probably a more insightful disclosure around the gross topline performance of the business that will replace billings as a metric.
Obviously, our cloud revenue growth is pretty solid at 89%, overall revenue growth at 37% for the quarter and importantly, software revenue growth, which is the license, basically on-prem plus cloud at over 40%. So if you thinking about well, how effectively are you guys growing, those are really the measures to stare at today.
And then quick follow-up to that, any chance that you provide RPO – change in RPO, I guess from a year-ago, so that we have comparable growth rates? Thanks.
Yes, I today our decision was to provide the sequential change. I do think that the metric will develop over the course of the year and we'll update our thinking around that to make sure that we're giving you guys the best view in terms of how to measure our progress.
Today, and of course, how we measure our own progress. We really want to share the way we measure ourselves with everybody externally. And today, we believe revenue is the key metric to follow and in particular, software revenue.
Okay, thank you Dave.
Thanks Jesse.
And our last question comes from the line of Mark Murphy from JPMorgan. Your line is open.
Hi, good afternoon. Thanks for squeezing me in. This is Matt Coss on for Mark Murphy. So CapEx for the quarter was $2.3 million, which seems to be a little low relative to last year's run rate? Will CapEx spending catch up to be closer to last year spending? And do you expect any catch-up to happen starting next quarter?
Yes, the start of the year, we set our expectation for about $25 million in CapEx for the year. Now it's not perfectly linear. Obviously, it's tied to the two things. One, the rate of on boarding employees and two what happens to be happening globally from a facilities perspective. Those are the two large consumers of CapEx. So I wouldn't model anything other than planned for $25 million for the year and don't change that estimate based on Q1 results.
Okay. And then your ratable bookings as a percent of total, I think your latest guidance, well, you say a couple of times 65% this year, 75% next year, I think was the fiscal 2020 guide. Is there a longer-term target you have for this or a theoretical upper limit and then maybe a timeline on [rev] timeline on when you get there?
Yes, at this point, there isn’t anything theoretical or aspirational beyond what we've provided for fiscal 2020, which is 75%. 65% this year and we’re pleased with the progress that we made in the first quarter and we're off to a good start in that regard.
Thank you.
Thanks Matt.
End of Q&A
Thank you. And at this time, I'd like to turn the call back over to Ken Tinsley for any closing remarks.
Great. Thank you, Bruce. Appreciate your help today. And thanks, everybody for joining us. We're available if you have any questions tonight. Have a good evening.
Ladies and gentlemen, thank you for your participation in today’s conference. This does conclude the program, and you may all disconnect. Everyone have a great day.