Splunk named a new CEO this week after a three-month search but faces critical challenges as it converts to cloud, and smaller, more nimble midmarket competitors nip at its heels.
Gary Steele will take over as Splunk CEO April 11, the company announced during its quarterly earnings call Wednesday. He was previously the founding CEO of Proofpoint, a security-as-a-service provider, and held leadership positions at Sun Microsystems and HP. Steele replaces Graham Smith, Splunk's board chairman, who served as interim CEO following the Nov. 15 unexpected departure of Doug Merritt, who'd led the company since 2015.
Hiring Steele quells some of the speculation about the company's leadership and strategic direction that emerged since Merritt's departure, which came amid volatile financial performance for the company throughout 2021 as it struggled to pivot from an on-premises-focused sales model for its security and observability products to a cloud-based approach.
Merritt stepped down after Splunk reported a decline in revenue for its fiscal year ending Jan. 31, 2021, and took a $1 billion investment from private equity firm Silver Lake Partners. Splunk's revenue growth and cash flow recovered in the fiscal fourth quarter of 2022, according to the company's earnings presentation, but its operating cash flow was in the red during the fiscal second and third quarters.
Gary Steele
During Wednesday's earnings call, the choice to hire Steele prompted one Wall Street analyst to bring up a mismatch between what Smith said the company wanted in a CEO when Merritt departed and Steele's qualifications. Steele grew Proofpoint from a startup to a publicly traded company with a market capitalization of $10.15 billion, but that's roughly half the size of Splunk's current market cap of $19.47 billion. When Merritt stepped down, Splunk officials said it was because the company needed a chief executive with the skills to lead the company's next phase of growth.
Smith responded to the analyst by noting that Steele has experience working for global companies in Sun and HP and has demonstrated the ability to lead growth at Proofpoint.
"He understands how multibillion-dollar enterprises work," Smith said. "But then we get enormous enterprise software experience, SaaS experience, cybersecurity domain experience -- just all of the things that ultimately blend together, we think, to provide the right leader for Splunk."
New Splunk CEO has security, private equity connections
Responses to Steele's appointment among industry watchers were mixed.
"[Splunk is] doubling down on security, which really is their main strength after log processing," said Rich Lane, chief strategy officer at Netenrich Inc., a security AIOps vendor in San Jose, Calif., who covered Splunk as an analyst from 2018 to 2021 and worked for the company as a professional services consultant from 2015 to 2016. "It also brings someone in that really understands SaaS."
Another former employee was less optimistic about the choice to hire Steele.
"It screams complacency to me, which is exactly what they do not need," said the former employee, who spoke on the condition of anonymity. The employee left the company recently after leadership upheavals, which included Merritt's departure as well as installing a set of new execs brought in from AWS in July 2021. "Splunk needs a shakeup, not status quo."
An IT analyst pointed out that Steele took Proofpoint private in April 2021, when it was acquired by private equity firm Thoma Bravo for $12.3 billion. There's also an indirect connection between Thoma Bravo and Silver Lake, which invested heavily in Splunk last year.
"[Thoma] Bravo and Silver Lake took SolarWinds private in 2015, then relisted it. I'd expect Bravo to merge Proofpoint with SolarWinds, and it wouldn't need Steele any longer," said Carlos Casanova, an analyst at Forrester Research. "I don't think the timing of Bravo acquiring Proofpoint in April and Merritt announcing his departure in October is too much of a coincidence."
Casanova put the odds at about 50/50 that Splunk may eventually go private, given the private-equity connections to Splunk's CEO changes.
Whether a vendor is private or public isn't necessarily relevant for its customers, but that possibility feeds fears among some observers that Splunk could be headed the way of BMC or CA, former industry bellwethers now seen as stagnant.
"If done properly and for the right reasons, it's a great model," Casanova said. "Unfortunately, many of them try to pull their cash returns out during that period while nobody can see. Look at BMC, the actions by those firms caused so many talented folks to leave -- they are only now starting to rebuild the internal visionary talent pool."
Splunk observability tools vulnerable to newer alternatives
Splunk also announced this week that its president and chief growth officer, Teresa Carlson -- who was among the former AWS executives Splunk hired last July -- will be leaving this quarter.
The recently departed Splunk employee called Carlson's departure after less than a year "shocking." Carlson and others hired from AWS last year had overseen what the former employee viewed as a shift away from practitioner-focused organic sales growth for its DevOps observability tools toward a top-down enterprise sales approach that he said frustrated him.
That top-down approach may have made cloud-native products it acquired with SignalFx and VictorOps competitively vulnerable to smaller, newer alternatives such as Datadog and AWS OpenSearch, among others, that can capitalize on the persistent reputation Splunk has for high prices.
It comes down to perception, and perception of value -- the way you typically buy Splunk is not from a bottoms-up, try-a-little-bit-and-then-expand perspective, like with AWS.
Former Splunk employee
"It comes down to perception, and perception of value -- the way you typically buy Splunk is not from a bottoms-up, try-a-little-bit-and-then-expand perspective, like with AWS," the former employee said. "[Customers] don't realize AWS is expensive until they spin up their 10th [virtual machine] and forget about two others. Early on, it seems super cheap."
Splunk has made progress in its transition from primarily an on-premises-focused business to leading with its Splunk Cloud Platform, according to executives on this week's earnings call. Splunk Cloud Platform, which hosts Splunk data and its analytics apps on major cloud providers' infrastructure for customers, now accounts for 62% of the company's revenue growth, and the company reported healthy earnings and profit margins for the fiscal fourth quarter and full year of 2022. Splunk has moved away from a reliance on perpetual software licenses as a primary source of revenue to a subscription-based model that includes workload-based pricing, a lower-priced alternative to the volume-based model, which charges customers according to the amount of data Splunk's back-end database ingests.
Volume-based pricing for Splunk Enterprise is not only priced higher up front, but it can also still lead to unexpected cost overruns for customers, according to Casanova.
"From a client perspective, we've had several inquiries [at Forrester where clients say] 'Hey, you know, we got Splunk, we're happy with it, but you wake up Monday morning and the bill has tripled because something went off the rails -- a job had to run three times, we're paying by volume and oh, my God, I don't know where I'm gonna come up with money.'"
Splunk officials said on the earnings call that nearly all Splunk Cloud Platform bookings in the fiscal fourth quarter were for workload pricing. However, Splunk senior vice president and CFO Jason Child assured Wall Street analysts that this won't ultimately affect Splunk's bottom line due to the general growth in infrastructure monitoring data with which all IT organizations must contend.
"Any customer that adopts workload-based pricing, they're putting in between one-and-a-half and two times more data into Splunk than they were before," Child said. "Customers are effectively paying maybe a lower price ... on a per-terabyte basis, but they're putting more [data] in."
Its observability tools still offer features, such as support for custom logging formats, that many smaller competitors don't, and is proven at massive scale among very large companies. Those companies also have so much data already stored with Splunk that completely moving away from it isn't an option.
But it's the long-term future that concerns some observers.
One large-scale customer said Splunk's leadership changes and pricing still have him thinking differently about how he uses the company's software.
"Our top [professional services] consultant just left [Splunk] because he felt like the company lacked leadership," said Steve Koelpin, lead Splunk engineer for a Fortune 1,000 company in the Midwest, in a February interview. "He took a lot of knowledge away with him."
Koelpin's company is making the move to Splunk Cloud Platform from on-premises Splunk Enterprise, but is also using tools such as Cribl LogStream to reduce the amount of data sent to Splunk.
"We're learning it's better to complement Splunk rather than trying to replace it -- transforming data in motion and increasing the density of our data, [which means] lower ingest costs," he said.
Koelpin said he's considered observability competitors as well but says there's usually one or two critical features they're missing by comparison.
"If I was a small company with no existing data platform, I'd start small with one of these smaller companies," he added.
The most prominent fast-growing Splunk alternative is Datadog, which reported 84% revenue growth for its most recent quarter and the addition of more than 100 new large customers with $1 million annual contracts for 2021 compared with 2020.
Datadog's overall revenues of $326 million in calendar 2021 are still dwarfed by Splunk's cloud revenues of $554 million for fiscal 2022. Splunk is reporting strong growth in cloud as well. But it's unknown how much of that growth comes from existing customers converting from on-premises to cloud deployments, and how much of it is from net-new customers.
Splunk's interim CEO Smith acknowledged Splunk has largely left the midmarket untapped during the earnings call.
"We've added ... a similar number of customers in the low thousands each year. ... There's an opportunity for Splunk in the midmarket that we haven't really fully gone after," he said. "That's certainly something that will ... be on [Steele's] list of opportunities."
Beth Pariseau, senior news writer at TechTarget, is an award-winning veteran of IT journalism. She can be reached at [email protected] or on Twitter @PariseauTT.
Gary Steele
