 Live from Washington D.C., it's theCUBE. Covering.conf 2017, brought to you by Splunk. Welcome back to the nation's capital, everybody. This is theCUBE, the leader in live tech coverage, and we're here at day two, covering splunks.conf, user conference, hashtag Splunkconf17. And my name is Dave Vellante. I'm here with my co-host, George Gilbert. And as I say, this is day two. We just came off the keynotes, more of a product orientation today. George, what I'd like to do is summarize sort of the day and the quarter that we've had so far and then sort of bring you into the conversation and get your opinion on what you heard. You were at the analyst event yesterday. I've been sitting in keynotes. We've been interviewing folks all day long. So let me start. Splunk is all about machine data. They ingest machine data. They analyze machine data for a number of purposes. The two primary use cases that we've heard this week are really IT, what I would call operations management, sort of understanding the behavior of your systems, what's potentially going wrong, what needs to be remediated to avoid an outage or remediate an outage. And of course, the second major use case that we've heard here is security. Some of the Wall Street guys, I've read some of the work this morning, particularly Barclays came out with a research note. They had concerns about that. And I really don't know what the concerns are. We're going to talk about it. I presume it's that they're looking for a TAM expansion strategy to support a $10 billion valuation and potentially a much higher valuation. It's worth noting the conference this year is 7,000 attendees up from 5,000 last year. That's a 40% increase growing at or above actually the pace of revenue growth at Splunk. Pricing remains a concern for some of the users that I've talked to. And I want to talk to you about that. And then, of course, there's a lot of product updates that I want to get into. Splunk Enterprise 7.0, which is really Splunk's core analytics platform. ITSI, which is what I would do, 3.0, which I would call their ITOM platform. UBA, which is User Behavior Analytics 4.0. Updates to Splunk Cloud, which is a service for machine data in the cloud. We've heard about machine learning across the portfolio really to address alert fatigue. And a new metrics engine called mStats. And of course we heard today enterprise content security updates and many several security oriented solutions throughout the week on fraud detection, ransomware. They've got to deal with Booz, Allen, Hamilton on cyber foresight, which is security as a service that involves human intelligence. And a lot of ecosystem partnerships. AWS, Dell EMC was on yesterday, Atlassian, Gigamon, et cetera, growing out the ecosystem. So that's sort of a quick rundown, George. I want to start with the pricing. I was talking to some users last night before the party. You know, what do you like about Splunk? What don't you like about Splunk? Are you a customer? I talked to one prospective customer. He said, wow, I've been trying to do this stuff on my own for years. I can't wait to get my hands on this. Existing customers though, only one complaint that I heard was your price is too high. Essentially, it was what they're telling Splunk. Now, my feeling on that, and Ramo from Barclays mentioned that in his research note this morning, Ramo Lencho. Top security analyst, securities analyst following software industry. And my feeling, George, is that historically your price is too high has never been a headwind for software companies. You look at Oracle. You look at ServiceNow, sometimes customers complain about pricing too high. Splunk. And those companies you tend to do very well. What's your take on pricing as a headwind or tailwind indicator? Well, the way you always set up these questions in a way that makes the answering them easy, because it's a tailwind in the sense that the deal sizes feed an enterprise sales force, and you need an enterprise sales force ultimately to be pervasive in an organization. Because you can't just throw up like an Amazon style console and say, pick your poison and put it all together. It has to be an advisory, a consultative sort of approach to working with a customer to tell them how best to fit their portfolio and their architecture. So yes, the price helps you feed that what some people in the last era of enterprise software used to call the most expensive migratory workforce in the world, which is the enterprise sales organization. Right. But what's happened in the change from the last major enterprise applications, ERP, CRM, and what we're getting into now is that then the data was all generated and captured by humans. It was keyboard entry. And so there was no, the volumes of data just weren't that great. It was human, essentially business transactions. Now we're capturing data streaming off everything and you could say Splunk was sort of like the first one out of the gate doing that. And so if you take the new types of data, customer interactions, there are about 10 to 100 customer interactions for every business transaction, then the information coming out of the IT applications and infrastructure, it's about 10 to 100 times what the customer interactions were. So you can't price the, your pricing model, if it stays the same, will choke you. See, you're talking about multiple orders of magnitude of more data. And if you're pricing by the terabyte, then that's going to crush your customers. But here's what I would argue though, George. I mean, and you mentioned AWS. AWS is another one where complaints of high pricing. But to me, if the company is adding value, the clients will pay for it. And when you get to the point where it becomes a potential headwind, the company Oracle is a classic at this, will always adjust its pricing to accommodate both its needs as a public organization and the company that has to make money and fund R&D and the customer's needs and find that balance where the competition can't get in. And so it seems to me, and we heard this from Doug Merritt yesterday, that his challenge is staying ahead of the game, staying, moving faster than the cloud guys in what they do well. And to the extent that they do that, I feel like their customers will reward them with their loyalty. And so I feel as though they can adjust their pricing mechanisms. Yeah, everybody's worried about 606 and of course, the conversions to subscriptions. I feel as though a high growth and adjustments to your pricing strategy, I think can address that. What do you think about that? It sounds like one of those sayings where the French say, well, it works in practice, but does it work in theory? But it has worked in practice in the industry, so what's different now? Okay, so take Oracle at list price for Oracle 12C flagship database. The price per processor core with all the features thrown in is something like 300,000, 350,000 per core. So you take an average Intel high end server chip that might have 24 cores and then you have two sockets. So essentially one node server is 48 times 350. And then of course, Oracle say, but for a large customer will knock 90% off that or something like that. Which is exactly what the Splunk guys told me yesterday. But it's... That's what I'm saying. They'll do what they have to do to maintain the footprint in the customer, do right by the customer and keep the competition out. If it's multiple orders of magnitude different, if you take the open source guys where essentially the software is free and you're just paying for maintenance. Yeah, and humans. Okay, that's the other advantage of Splunk is they've, as you pointed out yesterday, they've got a much more integrated set of offerings and services that dramatically lower them. And we all know the biggest cost of IT is people, right? It's not the hardware and software, but all right, I don't want to rat hole on pricing but it was a good discussion. What did you learn yesterday? You sat through the analyst meeting, give us the rundown on George Gilbert's analysis of .conf generally in Splunk as a company specifically. Okay, so for me it was a bit of an eye opener because I got to understand sort of, I've always had this sort of feeling about where Splunk fits relative to the open source big data ecosystem, but now I got a sense for what their ambitions are and what their sort of tactical plan is. So I've said for a while Splunk's the anti-Hadoop. Hadoop is multiple sort of dozens of animals with three zookeepers, I mean literally. And the upside of that is those individual projects are advancing with a pace of innovation that's just unheard of. The problem is the customer bears the burden of putting it all together. Splunk takes a very different approach, which is they aspire apparently to be just like Hadoop in terms of the platform for modern operational analytic applications, but they start much narrower and it gets to what Raimi's point was in that Wall Street review where if you take at face value what they're saying or you've listened just to the keynote, it's like, geez, they're in this IT operations ghetto and security and that's a Labre, a tar pit and how are they ever going to climb out of that to something really broad. But what they're doing is they're not claiming loudly that they're trying to topple the giants and take on the world. They're trying to grow in their corner where they have a defensible sort of moat and basically the- Let me interrupt you. But to get to five billion or beyond, they have to have an aggressive TAM expansion strategy kind of beyond ITOM and security, don't they? Right, and so that's where they start generalizing their platform. The data store they had on the platform, the original one, it's kind of like a data lake in the sense that it really was, it's sort of the same searchable type index that you would put under a sort of a primitive search engine. They added a new data store this time that handles numbers really well and really fast. That's to support the metrics so they can have richer analytics on the dashboard. Then they'll have other data stores that they add over time and for each one you're able to now build with their integrated tool set more and more advanced apps. So you can't use a general purpose data store. You've got to use the Splunk end data. It's kind of like Workday. Yeah, well, except that they're adding more over time and then they're putting their development tools over these to shield them. Now, how seamlessly they can shield them remains to be seen. Well, but so this is where it gets interesting. Splunk as a platform is an application development platform on which you can build big data apps. It's certainly, conceptually, you can see how you could use Splunk to do that, right? And so their approaches out of the box will help you with enterprise security. They call it user behavior analytics because it's a term another research firm put on it, but it's really any abnormal behavior of an entity on the network. And so they can go in and not sell this kind of fuzzy concept of a big data platform. They said they go in and sell to security operation center. We make your life much, much easier and we make your organization safer. And what they call these curated experiences. And the reason this is important is when Hadoop sells, typically they go in and they say, well, we have this data lake, which is so much cheaper and a better way to collect all your data than a data warehouse. These guys go in and then they'll add what more and more of these curated experiences, which is what everyone else would call applications. And in the research, Wikibon's done depth-first, or rather breadth-first versus depth-first, breadth-first gives you the end-to-end visibility across on-prem, across multiple clouds, down to the edge. But then when they put security apps on it, when they put DevOps or some future sort of big data, big data analytics apps as their machine learning gets richer and richer, then all of a sudden the idea is they're not selling the platform because that's a much more time-intensive sale and lots more of objectives. Those depth solutions. And then all of a sudden the customer wakes up and he's got a dozen of these things and all of a sudden this is a platform. Well, service now is similar in that it's a platform. And when Fred Loddy first came out with it, it was like here, he said, what do I do with it? So he went up back and wrote an IT service management app. And he said, oh, okay, we get it. Splunkin' is a similar way, it has these sort of depth apps and as you say, they're not selling the platform because they say, hey, you want to buy a platform, people don't want to buy a platform, they want to buy a solution. Having said that, that platform is intrinsic to their solutions when they deliver it. It's there for them to leverage. So the question is, do they have an application developer sort of kit strategy, if you will, whether it's low code or even high code and where they're cultivating a developer community? Is there anything like that going on here at .conf? Yeah, they're not making a big deal about the development tools because that makes it sound more like a platform. But they could. But they could. And the tools, so that you can build a user interface, you can build dashboards, you can build machine learning models. The reason those tools are simpler and more accessible to developers is because they were designed to fit the pieces underneath, the foundation. Whereas if you look at some of the open source big data ecosystem, they've got these notebooks and other tools where you address one back end this way and other back end that way and it's sort of, you can see how Frankenstein was stitched together. Yeah, so to your point, we saw fraud detection. We saw ransomware. We see this partnership with Booz Allen at Hamilton on Cyberforce site. We heard today about Project Waitono which is unified monitoring and troubleshooting. And so they have very specific solutions that they're delivering that presumably many of them are for pay. And so bringing ML across the platform which now opens up a whole ton of opportunities. So the question is, are these sort of incremental defend the base and then grow the core solutions or are they radical innovations in your view? I think they're trying to stay away from the notion of radical innovation because then that will create more pushback from organizations. So they started out, they started out with a sort of Google search like product for log analytics. And you can see that as their aspirations grow for a broader set of applications, they add in a richer foundation. There's more machine learning algorithms now. They added that new data store. So, and when we talked about this with the CEO, Doug Merritt, yesterday in the analyst day, he's like, yes, you look out three to five years and the platform gets more and more broad. And at some point, customers wake up and they realize they have a new strategic platform. And platforms do beat products. And even though it's hard to sell, if you have a platform like Splunk does, you're in a much better strategic position. All right, we got a wrap. George, thanks for joining me for the intro. I know you're headed to New York City for big data NYC down there, which is the other coverage that we have this week. So thank you again for coming up. All right, keep it right there. We'll be back with our next guest. We're live. This is theCUBE from Splunk.conf 2017 in the nation's capital. Right back.