From the Cube Studios in Palo Alto in Boston, bringing you data-driven insights from the Cube and ETR. This is Breaking Analysis with Dave Vellante. Cisco's $28 billion acquisition of Splunk represents a good outcome for Splunk and a strategic growth opportunity for Cisco. Splunk's painful transition to a cloud and subscription pricing model was largely through the knothole as seen by its margins and recent P&L performance. But questions remained with respect to its growth prospects and competitiveness in the hot observability space. For Cisco's part, the acquisition brings more software and additional $4 billion in ARR and a chance to grow Splunk's business, particularly internationally. Our initial research shows joint customers are generally positive on the deal, in particular with respect to Cisco's expanded portfolio, insecurity and observability.

Hello, and welcome to this week's Wiki Bond Cube insights, powered by ETR. In this special Breaking Analysis, Erik Bradley of ETR and I will share the results of ETR's flash survey, assessing joint customer perceptions and likely spending actions as a result of the Cisco acquisition of Splunk. Erik, good to see you, my friend. Thanks for coming on. Always great to be here. Thank you for having me. Yeah, okay, before we get into the survey, let's set the table with the recent rocky journey of Splunk. So, what we're showing here is a five-year chart of Splunk in the blue and the NASDAQ in yellow. Let's go back to 2019, that's the year Splunk acquired SignalFx in an effort to accelerate its pivot to the cloud, observability in a subscription model. And as you can see, prior to December 20th or December 2020, the street was buying into the story. Note Splunk's performance through November 2020 in the lower right outpacing the NASDAQ by almost 30 percentage points. But then it had a really bad miss on ARR when it announced earnings in December of 2020, December 3rd. And it suspended long-term guidance.

And while this was common practice at the time during COVID, Splunk had been holding firm on its pre-COVID ARR guidance and that was a tactical error. At that point, it became clear that the first disappointment, as the saying goes, would not be the last and the bears gained control as investors were treated from a company that was in transition. The stock got a bump when it was reported in February 22, that Cisco was offering $20 billion to buy Splunk. And around that time, the board removed Doug Merritt as CEO and brought in Gary Steele, a CEO with experience selling companies. The pain continued, but in 2023, we started to see light at the end of the tunnel as the transition started to show up on the income statement. And you can see the popup in price at the end of this chart as Gary Steele's handoff from Doug Merritt took hold, and Splunk got $8 billion more than Cisco's rumored prior offer.

And that brings us to where we are today. Now, while some voices are vocal, and that this is a bad thing for Splunk, as Erik and I reported in our predictions post in 2021, the spending picture for Splunk was clearly deteriorating. This chart shows the breakdown of ETR's proprietary net score methodology, which is a measure of spending momentum shown in the blue line. The green bars are spending more, the red bars are spending less, and the bright red is churn. And Erik as we called out two years ago, competition and transition were not friends of Splunk. The point is, Cisco in many ways represents a lifeline and avoids Splunk's board having to do a heavy lift. Erik, your thoughts on all of this? Yeah, there's a lot there. First, I want to state, we also called this Cisco large acquisition and security in one of our predictions posts. So it's very hard to get one of those right. So a little kudos to you and I, Dave. (Erik laughs) But also about the stock price, amazing that they were able to get $8 billion more. One of the things that concerns me is that a 4 billion in annual ARR, it's going to take Cisco a very, very long time to recoup that money. However, as we're going to dig into soon, there's a lot of potential synergies here. And overall, the sentiment skewed positive among their client base. Another thing that I think we should just talk about a little bit is the Splunk data, completely spot on. We've been catching a downward trend, deceleration and spending intentions for quite some time, particularly in what we call the analytics big data sector.

It's really starting to drop. The SIM is holding up a little bit better, but the amount of competition in that space is just overall grueling and it's going to get worse. I think the real key here is a combined entity is not only integration, but then innovation on top of it. These two combined entities really need to take all this data telemetry they're now going to have and turn it into a great XDR if they're going to be able to compete with the other competitors in their space. Alex, bring back this slide because while it shows a worrisome spending deceleration in the blue on Splunk's combined platforms, the yellow line, which represents pervasiveness in the dataset, it's held up pretty well, though it's beginning to wane. So the Cisco acquisition comes at the right time. Okay, so let's get into the customer analysis. First, let's look at the overlap of Splunk accounts and Cisco accounts overtime. And Erik, I wonder if you would take us through this time series chart and what we're looking at here. Yeah, certainly. So what we're looking at in this first slide is what we call our proprietary shared accounts analysis. And what we do is we overlap citations. So on the left-hand side, you would see that this was 665 different Cisco customers, only within analytics, big data and security. So we kind of took out the Meraki networking, all of those type of situations. So among those 665 customers that cited a spending intention on Cisco, we also see that almost 50%, a little over 49% also were customers of Splunk. So the overlap here is fantastic. This is where we're starting to see some of the great synergies. Also, from your point of the timing, this has been rising for years. And in April of this year was the first time we saw a small downtick. It went from 53 to 49. So the timing of this might be really good to kind of stop that deceleration from happening any further. Okay, thank you for that. And so Erik and I spoke right after the acquisition was announced, and he said, "Hey, we could do a flash survey." So we fired up a shared doc and we came up with a number of questions that the ETR analysts and our market analysts put together. And Erik, before we get into the results, explain the survey composition, the nuances, and of course, the caveats of the n. Yes, so we want it to be fast, right? This is the type of thing that you can do when you're a more agile type of survey company. And I think it's one of the great prowess of ETR. So, for that reason, we weren't looking for an n of 3,400, but what we can do, and which I think is really cool about this survey, is the 66 people we cited and we did it in less than a day, are customers of both Cisco and Splunk. And we were able to do that very quickly, and we were also able to do it across only large enterprises, which we categorize as 1,200 or more employees. So overall, the caveat to the survey is, it's not the largest citation in the world. Our quarterly surveys capture 16, 1,700. So it wasn't meant to be the broadest, but it was meant to be targeted. So these are large enterprise customers of both Cisco and Splunk. I don't know who else we could have gotten a better early reaction and sentiment gauge from. Yeah, and it's predominantly North America. There are, I think, 10 international citations. Okay, let's get into the results here. These joint customers were asked, "How do you view this acquisition in terms of Cisco's product suites, Splunk's product roadmap, and your company's likely utilization of either company's products as a result of the acquisition? And this shows the positive plus the very positive responses. So pretty good positive momentum here for both companies or sentiment for both companies, especially Cisco and Cisco's positive sentiment increases as you filter on the Global 2000. I think roughly half of the respondents were Global 2000. It jumped up to almost 70%. As well, the sentiment from overseas customers, again, the warning is a small n of 10, but still it's 10, but it was overwhelmingly positive.

It was nearly a hundred percent. So, Erik, anything you'd add to this? Do you agree with that takeaway? Yeah, I do. I mean, it certainly skews positive there. There's really no denying it. It's a little bit more positive on the Cisco side than the Splunk side, but still overall it skews positive. The one interesting thing here is that actually of all the customers, the lowest sentiment, it was about their utilization of the companies combined. So it's good for Cisco, little bit less so for Splunk, but still good, but the customers aren't so sure it's good for themselves. So that's something that's going to be interesting to watch. Yeah, so let's double click on that a little bit. Now, despite the positive sentiment, we wanted to understand the risk of defection. You saw in that earlier slide, the red, there was a very small churn, maybe 5%, the spending less was going up. But this data represents responses to the question, how likely are you to find an alternative to Splunk, obviously as a result of this acquisition? And it's mostly wait and see or 39% unlikely. But there is a worrisome 17% that said likely and a very small sort of matching that churn, 5% said very likely, Erik, that 5% again is about what we saw in the previous net score granularity. I didn't go through the granularity, but it's a more sophisticated than I laid out. So maybe not so worrisome, but how do you interpret this data? Well, the difference here between that and when we capture just a general replacement of a vendor in our syndicated quarterly surveys is that this was asked about specifically based on the acquisition. So that 5% is troublesome. They're very likely to leave, so they'll be a small amount of churn. But the real takeaway here is that 39% were neutral, so the acquisition's going to have no impact. And then the other 39% said they were completely unlikely to leave. So I mean, the majority of this is that still a pretty good reaction from the customers. But yes, I think from a headline perspective, the company needs to be aware of that 22% that said this deal's more likely to make them look for alternatives. And let's be honest, there's a lot of alternatives out there. Again, I'm going to go back to what I really think the key to this entire deal is, is Cisco in the past has made acquisitions, but hasn't integrated it well.

They need to put that behind them. They need to make sure this integrates and then they need to innovate on top of it. I would love to see a real industry leading XDR come out of this because Lord knows they're going to have a lot of data telemetry. Great points. And that's something that Cisco can manage. They have that, I believe, is in their control. Let's now look at the likely spending patterns of customers, what they expect based on this deal in terms of new products, modules or features from Cisco and Splunk and Erik, nearly half of the customers in nearly 40% said they're likely to turn on or spend more on Cisco and Splunk new products, modules or features. And I find this pretty positive with a very small percentage saying unlikely. What are your thoughts here? Agreed. I mean, I think it's fantastic. I mean, basically, what this is showing is that even though they're two incredibly pervasive companies, there isn't much product redundancy here. That's why it was a really smart acquisition. They're a better company together than they were standalone. And this is a very positive aspect, particularly for Cisco, because you can see the data, again, skews a little bit more positively for the Cisco side than the Splunk side, but still on both sides, they're more likely to turn on new features and modules. That is all you can ask for when you make an acquisition this big. And I'll come back to the other point at 4 billion ARR in annual for Splunk, that's going to take seven years to recoup this cost. So they better increase that ARR so it's a little bit less time. Okay. As we've said, security and observability are the big areas where Cisco will accelerate once the deal is closed, which is going to take at least until this spring. Here's a look at what the customers see as the positive impacts of the deal. Security's the big winner followed by investment, leverage, and then expanded observability offerings. We'll talk about that some more. And while many have positioned this as an AI deal, joint customers don't see enhanced AI capabilities as advantageous, although there is a data angle there. Erik, what would you add to this? I think you pretty much gave a good analysis of this one. I think something that's really interesting here, though, is the very small amount of citations on that advanced AI capabilities. This kind of speaks to the trouble that both companies were having on a standalone basis. So to a certain extent, the game was sort of passing them by. And I don't know what they're going to do about that, but with only 22% saying that was a positive of this deal, the problem still exists, right? So the the great part here is that everyone views this as an expanded security and enhanced security offering for them, which is fantastic, but they still are going to have this sort of advanced analytics problem on their hand. Yeah. And it's gets vogue to say AI, AI, AI as much as you can. So I get that. And I do think there's some legitimacy to the fact that Splunk has been in the data business and been doing AI for a long time have many, if not most software companies. But this is not specifically an AI deal. Okay, let's now look at the negatives and what concerns customers. No big shock, customers are worried about higher prices, loss of focus, a possible brain drain out of Splunk. and a smaller percentage are worried about lock-in, even though they're probably pretty locked in and dilution of innovation and supporting Cisco's assertion of... So this data supports Cisco's assertion that there's not a huge product overlap. That doesn't seem to be a major concern here, Erik. Yeah, the second time we've seen that, that there's no product redundancy, which I think is just fantastic if you're executives of Cisco right now, so you're very likely to cause churn or lose customers based on that. But the number one concern is high prices. But the truth is that was existing for Splunk anyway. I've been capturing that in my panels and ITDM interviews for years. So I don't know if anything changes here, anything involving Splunk has always been concern about lock-in and prices. But despite that concern about pricing, there's still incredibly sticky. And I think the question you would have to have if you were a Cisco executive at the moment is how much room do you have to raise pricing at this point? I think that's a question they're going to have to test and figure out, but there is a concern. And even if they do raise prices, it does seem like most customers realize that they're locked in and they're kind of okay with it, to be honest. So until something really, really intriguing comes along with a lower price and the same efficacy, I think they're going to be okay for a while. So let's look at that. As Erik says, pricing has always been a top concern in Splunk's customer base. So we wanted to understand, drill down on that. What are customer's thoughts on pricing? Nearly half of the respondents said, "We don't like the pricing, but we feel locked in now." I mean, Splunk has a very large install base, it's got a loyal install base. Customers really, really like the product. They have processes and procedures built up around it. So hey, it's kind of like Oracle in a way this is a positive for investors, meaning the business case to stay is better than the switching costs and the risks of migration. As well the second bar here is software pricing. No matter what, it's never perfect. No matter what pricing model a company chooses, it's never going to please everybody.

And then not surprisingly, less than 10% of joint customers love the pricing model. Why would you ever answer a survey that says, oh yeah, we love the pricing? I mean, right, Erik, it's rare to say that, that they like the pricing. Any other comments on this data? Well, first of all, it's completely anonymous, so if they did, it's not going to come back to haunt them in any negotiations. Just want to reiterate that to all of our ITDMs, the thousands out there that contribute and thank you for what you do. Yeah, we've been hearing about this forever. This is sort of like old news type of thing. Splunk is extremely expensive and people have been looking and seeking different type of pricing models from them. I've heard people say that the problem with Splunk is they have to decide what to leave on the cutting room floor. And when you're talking about security, that's dangerous. You want to ingest everything. You want to store everything. And that's going to change. These new competitors are out there have cheaper pricing, have better storage, longer record keeping. So these guys still have their job in front of them to stay relevant and stay on top with all the competition that's out there. But, again, I think this move is going to make them better equipped for that than worse. Okay, the last data point we want to show relates to the Cisco and Splunk responses to a question from an Oppenheimer analyst. This was on the call. This individual asked, "Why did you buy a legacy company instead of an emerging company with a more modern architecture? An obvious target there would've been, for instance, Datadog. In that scenario, by the way, Cisco, they would've gotten 40% of Splunk's revenue and more than double Splunk's revenue growth rate, but it would've had to pay well north of $30 billion. Elastic is another one, maybe much, much smaller company and wouldn't have had the near term potential of Splunk. At any rate, the response, Cisco CEO Chuck Robbins and Splunk CEO Gary Steele basically said, "Look, the world is hybrid, multi-cloud, and our strategy aligns with that." More than 2/3 of respondents agree with these statements.

Interestingly, the number one response speaks to the complexity of the hybrid approach, but it's got good value. Complexity is something that Cisco is aggressively trying to address. We've covered this in previous breaking analyses. So that's an opportunity there. 14% say it's hard and of poor value. So there's some work to be done there, Erik, as you point out. And then 13% say Splunk dismissed the boat on cloud. Erik, to me, this sentiment is very manageable. Like you say, they got some work to do, but if Cisco focuses on it and they've got a competent management team for sure, and it speaks by the way to the challenges that Splunk would've had remaining independent. Cisco can hide a lot of those warts because of its massive portfolio, it's got great service, global coverage, and it can invest in addressing some of those shortcomings with much greater resources than Splunk had available to it. Your thoughts? Yeah, I do think this is still going to be a problem as we move more towards serverless containers and those type of things. But for right now, the world is hybrid. Splunk has a great foothold in any regulated type of industry as well. So that's always going to stay a little bit on-prem in hybrid. So I do think that the core base here is... And then, look, even though some of them said that there's a little bit of complexity, we're talking about 48% of them basically said they were satisfied and a lot of them were kind of neutral and not sure. So again, this skews positive. I think that in all large enterprises, this is a good takeaway from them. Certainly a manageable problem, but one that's going to persist. It's not going away anytime soon. So I still think there's a big road ahead of them to stay relevant, but in the meantime, they're certainly collecting a lot of cash and they are certainly a very sticky business. So I think that cash and that stickiness will help them give them some time to solve this problem. All right, let's close, summarize and look at some of the things that we're going to watch in this deal. First point is Cisco really needs a catalyst to its $4 billion low growth security business. And rather than buy a bunch of little tuck-ins, which is my friend Zeus Kerravala says, Cisco is the king of, Cisco decided to go big . and this could be a nice boost to G2, Patel's security business. Remember G2 brought in Tom Gillis from VMware to help get that business going. And that was a major executive hire. And so this is a big, big move. Observability which includes assets like AppD and ThousandEyes also gets a boost. So both security and observability are data-heavy businesses. And with Splunk's data and analytics prowess, both of these groups can benefit from more predictive capabilities, what Erik and I were talking about before in AI.

Look, while Splunk is not necessarily synonymous with AI, it's been using machine learning and AI for years. And let's face it, AI starts with data. The big question is, as Erik said earlier, integration into Cisco's current business model and how it will be organized. One of the criticisms of Cisco has been its slow pace of deep integration with its acquisitions, creating more complexity. Meraki, for example, it took many, many years, like eight years before it's even its catalyst gear could be seen on the Meraki dashboard. The deal is going to take eight to nine months to close. It's going to be another year before Cisco figures out the integration. So that's something that we'll be watching closely. We talked about the impact on the Cisco P&L and cashflow. $4 billion in new ARR, cashflow accretive in year one, but Cisco promised to continue the buybacks and the dividends.

They also promised to continue operating leverage. So on paper, it's a real plus for investors and Cisco has plenty of room on its balance sheet to take on a bit more debt not withstanding the higher interest rates. And this is a cash plus taking on some debt deals, a cash deal, but to take it on some debt to pay for it. The other point is for Splunk to accelerate growth, it would've had to invest heavily in global expansion, which is extremely expensive and time-consuming. Cisco's international footprint is massive. and with only about 15% of Splunk's business being overseas, there's a real upside there in our view. And as it relates to pricing and lock-in those types of issues, Cisco's going to have to make the business case for staying better than migrating. And I think they'll successfully do that.

One thing, Erik, we didn't mention is cultural fit. I mean, our sources indicate that the initial Cisco offer and discussions weren't attractive enough for Splunk's board from their standpoint. And Cisco basically said, okay, let Gary Steele finish the transition, do some more cleaning up. And that turned out in hindsight to be worth an $8 billion premium for Cisco relative to what they had offered reportedly in February 2022. And much of that work has been done. So, Erik, give us your final thoughts on this deal and the things that you're looking for. I think it's a fantastic deal from Cisco's perspective, albeit expensive. Again, I think they're going to make sure they turn on new features. They have to leverage the customer base on both sides and either increase pricing or increase features and modules because this is a very expensive deal. And without increasing the ARR on the Splunk's side, it's going to take a very long time. But like you said, cashflow positive, so I think it's a wonderful deal for them. I'm going to reiterate that integration is the key here. There's been too many times where they've been able to acquire something, but then just sort of leave it on the vine and not bring it into the fold. It's this time they really need to bring it into the umbrella and pun intended on that one. And also, you mentioned networking. I think it's really important to point out in our data that Cisco and the networking in Meraki particular is one of their better spending product lines.

It it is really holding up well. So the data telemetry that these two combined companies are going to have is massive. And I really think they have to find a way to leverage that and increase their security going forward. And if they can do that, this is incredibly synergistic. and I think it's going to end up being a fantastic deal for not only shareholders but the companies and hopefully the customers themselves 'cause at the end of the day, we all know those are the ones who are going to dictate whether this works or not. You know, let me ask you something here 'cause you're former equities analyst. My rudimentary, my valuation style, I love to look at revenue multiple, which is only one of tiny way in which you should value companies, but I'll say this, Cisco trades at, I want to say, four to five times revenue. And so while at 4 billion in ARR, it's going to take a long time to pay back. He said seven years, payback 28 billion. From a valuation standpoint, if they can boost it a little bit and get 5X that ARR, it's not going to take as long potentially. If they can get that to let's say 6 or 7 billion in ARR at a 5X valuation, they'll make it back in valuation terms for investors. What do you think about that? I agree. I'm trying to very quickly look up what their revenue growth was because it doesn't matter four or five times. It depends on... That's all going to determine by the pace of growth that they have. And it looks like right now on revenue growth, they're estimated to grow only at 1% to 2024, so that four or five times for 1% growth, that doesn't seem that high. And now don't quote me on that, that was a very quick look while we're doing it, but they're going to need to boost that revenue growth to maintain multiples or see a valuation lift in that multiple. But the way you're thinking about it is absolutely correct. Sure. If they can use this to boost revenues and there's no doubt they're going to be rewarded for it. Was that 1%? Was that Cisco's growth rate or Splunk's? That's at Cisco,. Yeah, okay. I think there was an anomaly in those figures. I think Cisco is committed to, I want to say, 6% or even higher. It's like mid to high. (indistinct) 2% for 25 on the out year. But again, this is real quick. I should have had these numbers prepped, but just off the top of my head, maybe there was an anomaly or an accounting issue there. And this certainly is not factoring in the new acquisition, so that numbers are certainly going to go up and they will be rewarded for it. Now, the thing is, the street usually moves very quickly and the stock reaction to this was muted at best. So I think they're going to kind of prove it type of mode, at least when it comes to the equity analysts out there because we saw a huge bump, 20% to Splunk side based on the great job they did on getting the most money possible. But on the Cisco side, as the acquirer usually is, it's a little bit muted or down, so we'll see what happens. But right now, I think the street is taking a wait and see approach and making sure that the synergies are there, the integration happens, and they actually do start seeing some cash flow positive and some revenue growth out of this. Yeah, Cisco lost, I want to say, I don't know, $6-8 billion of value on the day of the announcement. So that's obviously the street viewed it as somewhat negative. Although listening to the analyst's comments, they were generally positive. And you know, the analysts, they want you to not spend any money and continue to grow, continue to throw off cash, don't make strategic investments, keep paying back dividends. Right. I mean, it's a CEO. That's why CEO job is so lonely. All right, Erik, hey, awesome to have you. Thank you so much to the team at ETR for doing this flash survey and record time and the great work that you guys do. I can't say enough about the partnership, man. Thank you so much for having us. At any time you need some data, just let us know. You know where to call. All right, you bet. Okay, thanks to Alex Myerson who's on production and manages the podcast and Ken Schiffman as well. Kristen Martin and Cheryl Knight, they helped get the word out on social media and our newsletters. And Rob Hof is our editor-in-chief at siliconangle.com. Thank you, all. Remember these episodes are all available as podcasts. Wherever you listen, just search Breaking Analysis podcast. Please subscribe. I publish each week on wikibond.com and siliconangle.com. And you can email me at david.vellante@siliconangle.com or dm me, @dvellante or comment on my LinkedIn posts. And please do check out etr.ai. They're accelerating their investments. They do so much, so many surveys like this, like this flash survey and also in emerging tech survey that they've accelerated the pace of that. In addition to the technology spending intention survey, which we quote and reference so much here on Breaking Analysis, best survey data in the enterprise tech business. This is Dave Vellante for theCube Insights, powered by ETR. Thanks for watching, everybody, and we'll see you next time on Breaking Analysis.