top of page

I think Splunk will continue to be a leader in the field of ingesting, indexing, and analyzing machine-generated data for the foreseeable future. Machine data is expected to grow increasingly widespread and have an effect on every aspect of an enterprise's operations. Splunk has a long runway for growth as it strives to maintain its dominance in the enterprise market against competitors such as Dynatrace and Datadog. The main use cases for Splunk's products are security and full-stack monitoring and analysis (FSMA). Splunk's SIEM, or security information and event management, functions as a highly developed alert system on the security front, sending out notifications whenever any suspicious behavior is detected on a client's network. The security orchestration, automation, and response (SOAR) software from Splunk is designed to automatically prioritize these problems. Combining SIEM with SOAR software gives an enterprise's IT personnel a break by employing artificial intelligence in order to prioritize security risks. As a result, there are a lot less alarms that need to be manually handled. The FSMA market is young and emerging as a way to bring together and integrate diverse elements of an enterprise's monitoring architecture. Splunk's FSMA product aims to provide businesses with a single point of access to monitor every aspect of their IT infrastructure, from end user experience to application performance logs. Enterprise users may eliminate these data silos and monitor the whole IT stack from a single consolidated platform thanks to Splunk's solution. I think Splunk's high customer switching costs necessitate a small economic moat. I The fact that more than 90% of Fortune 100 companies use Splunk's services is testament to Splunk’s amazing ability to analyze and prioritize data. Additionally, Splunk's excellent cloud dollar-based net retention, which has regularly remained above 120%, is also validation that it’s product works, and customers I happy. I continue to be optimistic about Splunk's potential for long-term development due to its capacity to acquire significant clients and successfully upsell them. Market research indicates that during the coming several years, high double-digit growth is expected in the security and FSMA sectors. Given that Splunk is a market leader in both, this is encouraging. However, I anticipate Splunk will significantly outpace the market given its business clientele, extensive solution set, and current penetration into many sizable organizations. Currently, cloud services account for about half of Splunk's sales. The mix change will skew more cloud as the company transitions to the cloud, with the vertical finally accounting for about 90% of the firm's top line over my stated estimate. This change will make it simpler to deploy, upgrade, and update Splunk's software. All of these advantages may favourably affect the rate of cross-selling and up-selling as a result, thereby driving top-line growth. Pressure is put on the top line, gross margins, and operational margins as a result of cloud transitions. The top line is under pressure as customers switch from term licencing agreements, where a large portion of revenue is front booked, to cloud agreements, where revenue is a steady stream of smaller payments. Because of this distinction, Splunk's growth rates have recently slowed down. We can concentrate on annual recurring revenue, or ARR, as a good gauge of actual sales without accounting distortions because of the variations in the top line. I estimate that Splunk will generate total annual revenue of over $4 billion in the next fiscal . Over the previous five years, Splunk's business has reported strong gross margins, averaging over 80%. Gross margins have, however, shrunk (temporarily) as a result of the cloud move. This is a result of the high cost of cloud infrastructure. As the business grows and scales, I do anticipate that this expense will decrease. As a result, as I near the conclusion of my forecast, I am predicting GAAP gross margins in the mid-80s. Additionally, as the business develops cloud-based solutions and migrates its term-license consumers to the cloud, rising research and sales expenses have had an impact on operating margins. However, as Splunk advances through its cloud migration timetable, the margin pressure should lessen. Using a 13.5% discount rate implying a 9.5% equity risk premium, I forecast Splunk’s fair value to come in at $142. This implies a terminal free cash flow margin of 30%, a terminal growth rate of 5%, and a CAGR of 19% over the next ten years, and a longer term average growth rate of 6%.


I think Splunk deserves a narrow-moat grade because its products have high customer switching costs. Simply said, Splunk gives its users access to a platform that can ingest, index, and analyse vast amounts of data while providing full-fidelity monitoring and insights. With secular headwinds at its back and a wide range of fundamentally sticky product offerings, I think Splunk is quite likely to produce excess returns over the the next 10 years and, therefore, merits an economic moat. With its SIEM and SOAR services and its forays into the observability and IT analytics domains, Splunk is a leader in two important markets: security and full-stack monitoring & analytics (FSMA). Companies that specialise in SIEM, or security information and event management, often consume large amounts of machine-generated data (typically in the form of log files) and generate real-time analysis of a company's security architecture. Consider SIEM to be a properly maintained alert system: once any unusual behaviour is discovered, the SIEM software will send out an alert, alerting the IT team (ideally in real time). Receiving an alert to take action is only beneficial if the volume of alerts is kept controlled. However, the volume of warnings to a typical IT security team can be overwhelming due to the explosion in machine generated data, which is mostly caused by increased digital connectivity. Enter security orchestration, automation, and response, often known as SOAR, which serves as the handmaiden to SIEM. By employing artificial intelligence to prioritize security threats, SOAR software gives an enterprise's IT team a break and results in a significantly lower volume of warnings that need to be manually handled. In order to contextualize this, Blackstone decreased the mean time to resolution, or MTTR, for malware alarms from 30-45 minutes to 40 seconds by utilizing Splunk's SOAR functionality. I anticipate that the markets for SIEM and SOAR will expand as machine produced data keeps growing. In my opinion, economic moats are naturally attracted to the SIEM and SOAR spaces. Products like SIEM and SOAR can quickly become crucial to business security and operations, making switching to a different vendor very challenging. Additionally, switching to a different provider could result in data loss or a security breach, which would raise switching costs in the SIEM and SOAR space. Switching gears, the full-stack monitoring and analytics, or FSMA, field is emerging as a means of bringing various components of an enterprise's monitoring architecture together and together. FSMA service providers aim to provide businesses with a single location to monitor all aspect of their IT infrastructure, from end user experience to application performance. The ability of a provider to ingest massive volumes of data, integrate it, and then draw conclusions that will improve business outcomes is a crucial factor in the FSMA area. Prior to the introduction of FSMA, there were many inefficiencies as IT personnel manually combined the outputs to create a meaningful picture of the overall performance and health of the infrastructure. Enterprise customers may now eliminate these data silos and monitor the entire IT stack from a single unified platform thanks to FSMA suppliers. As a participant in each of these markets, Splunk has been able to provide value by leveraging proprietary technologies to set itself apart from its rivals. The ability of Splunk to index huge amounts of data, regardless of format, comes first and foremost. One of the key features that sets Splunk apart is its capacity to ingest unstructured data. Customers of Splunk have access to the company's "schema-on-the-fly" solution, which enables them to enter unstructured machine data and extract valuable insights from it. The enterprise's IT process is significantly impacted by the enhanced flexibility in two ways. In the first place, it does away with the requirement to standardize machine-generated data to a single input language, saving IT work hours. Second, because unstructured data is not transformed to suit a specific form, a wider range of studies can be performed on the data. Splunk can store and analyze each and every signal on a client's backend or frontend thanks to its capacity to quickly ingest enormous amounts of data via forwarders. Another way that Splunk stands out from the competition is with its full-fidelity, no-sample approach. I know from basic statistics that repeated sampling yields an unbiased estimate of the mean if the samples are large enough. I nonetheless acknowledge that sampling errors do exist, causing the error rate to be more than zero. Maintaining full fidelity, or effectively monitoring every signal, is the only method to remedy this problem. However, in order to do so, it is necessary to be able to consume, index, and analyze far more data than is possible through repeated sampling—an achievement Splunk has been successful in achieving. Tesco, a well-known international store, is an excellent illustration of how businesses may use Splunk's product line. More than 100,000 Tesco consumer touchpoints have incorporated Splunk, which everyday consumes more than 33 terabytes of data. The entire organisation, from order fulfillment to customer assistance, is integrated with Splunk. Tesco can view and track crucial areas like the condition of its IT infrastructure, the security of consumer transactions, and supply planning using Splunk's dashboard. In the future, Splunk will help Tesco with its digital transformation. Strong switching costs, which may be attributed to Splunk's entrenchment in its client's business and the efficiency gains connected to sticking with Splunk as the vendor for either security or monitoring needs, are what I believe to be Splunk's economic moat. Since Splunk is a leader in the SIEM market, I anticipate that it will continue to succeed in the complementing SOAR market. The tendency to avoid loss is present in both people and organizations. This, in my opinion, is especially true in the context of IT security. An organization runs the risk of operational hazards when changing SIEM or SOAR vendors, including data loss during the switchover, project execution, and operational interruption. The switching costs will be higher the more vital the function is and the more touch points a provider has within an organization. Any security-related data loss, disruption, or lapse to be a significant expense of changing vendors. I believe that businesses will often choose the finest product available if it offers the functionality they need. I seldom ever see examples of businesses switching to a different security vendor once this product is launched, which can require weeks of training and expert assistance. This reality is evident in numerous Splunk data points. A metric of upselling to current customers that nets out turnover is called net dollar-based retention (NDBR), and it is the best in its class at 130%. Further evidence that customers are not only sticking with Splunk but also continuing to spend more on the company's goods and services comes from the annual recurring revenue, or ARR, expansion for clients throughout various time periods. Due to its better ingestion and indexing capabilities, Splunk is able to acquire substantial amounts of data as soon as its SIEM and SOAR join a client's ecosystem. This information enables Splunk to enhance its own dashboards, alarm systems, and triaging frameworks for that customer on a regular basis. Because of this, a client would have to start over when developing those intricate dashboards and alert systems if they switched from Splunk to another provider with a foundational product as good as Splunk's. I see these productivity improvements as instruments to further integrate Splunk into the customer's environment. Once more, this repeated process increases switching costs for businesses who, as was indicated above, choose vendors based on features rather than just price. I see Splunk's aggressive stance inside the FSMA market to be equally moatworthy. It's critical to take into account the scope and size of both Splunk's clients and its own FSMA services in order to comprehend this competitive situation. Large businesses and significant public sector organizations have usually been the focus of Splunk's marketing efforts. The advantage of this tactic is clear: although harder to acquire than down-market competitors, larger businesses often have more loyal customers.There is often a movement along the upselling timeline as a firm embraces Splunk's observability suite along with its IT analytics capabilities, as Splunk is able to grow its effect within the company. As previously indicated, Splunk's iterative learning algorithms draw knowledge from the machine-generated data the company produces and are able to enhance monitoring and increase corporate productivity. This is a multi-stage game, and as technical users get more accustomed to the monitoring platform that keeps becoming better, each successful step solidifies Splunk's services even more. Indicators of the company's effectiveness in implementing its land and expand approach include the retention and ARR expansion measures mentioned above. It is important to remember that any move to the cloud makes it harder to keep customers. For instance, Splunk might want to switch one of its current clients from a term license to a cloud-based arrangement. The client may, for good reason, only want to switch to Splunk's cloud service when the term license is almost over. There is a sweet spot where the client can successfully switch from Splunk's platform to a rival's without agreeing to the cloud arrangement. In a broader sense, the business undergoing a cloud transformation essentially unlocks the departure door but requests that the client stay. The lack of customer churn during the cloud transitions shows that Splunk is successfully executing this change. That is to say, the customer complied with Splunk's requests to stay each time. This measure, in my opinion, illustrates how sticky Splunk's solutions are since even when customers have the best opportunity to leave, they don't. Splunk's new workload pricing model, in my opinion, is the appropriate move for the company's land and expand strategy. Customers used to be charged by the amount of data they presented to Splunk for analysis or monitoring, or by the amount of data they actually absorbed. Customers pay for the actual analysis and monitoring under workload pricing, regardless of the magnitude of the original ingestion. Paying for either the input or the process results in a significant difference. Enterprises will import more data into Splunk if there is no cost to do so. Once Splunk has access to this data, the larger amount will enable Splunk's AI engine to continuously advance, which will enhance the results, whether they are in the security or FSMA spaces. Businesses store and spend money due to enhanced output and pricing that is less strict than the quantity of space designated for ingestion. After using the workload pricing model, Splunk's products cost significantly more. Since Splunk can produce superior insights into a company's operations as a direct result of the increased data input, I believe that this pricing model will result in more sticky products.

Capital Allocation

Based on Splunk's stable balance sheet, fair investments, and appropriate shareholder payouts, I would say that Splunk’s capital allocation is standard. I consider Splunk's financial position to be strong even though the firm's long-term debt now exceeds its cash on the balance sheet. Additionally, I believe that the firm's products are less cyclical because to their stickiness because customers do not drastically cut back on their Splunk spending during recessions. This downside protection will allow the company to continue generating a significant amount of cash flow in the future, strengthening its balance sheet. Splunk's approach to investing has been straightforward and sensible. The company has made wise investments, which may be divided into two categories. First, Splunk has made significant investments in its own products and establishing a loyal customer base. The firm's technological advancements are a result of this organic investment. It has made improvements to its enterprise clients and logs. Second, Splunk has also been shrewd in its approach to acquisition, investing in businesses that have enabled it to diversify its portfolio to include metrics and traces. I consider these efforts to be essential given the company's involvement in the observability domain, where metrics, traces, and logs serve as the core building blocks. I anticipate Splunk will keep making modest acquisitions in addition to its organic investments as it develops a complete monitoring and security platform. Splunk does not pay a dividend and rarely buys back shares of its stock. Considering that the business is mainly focusing on its growth engine, which should yield positive returns over my explicit forecast.


bottom of page