 From theCUBE studios in Palo Alto and Boston, bringing you data-driven insights from theCUBE and ETR. This is Breaking Analysis with Dave Vellante. Cisco's $28 billion acquisition of Splunk represents a good outcome for Splunk and a strategic growth opportunity for Cisco. Splunk's painful transition to a cloud and subscription pricing model was largely through the knot hole as seen by its margins and recent P&L performance, but questions remained with respect to its growth prospects and competitiveness in the hot observability space. For Cisco's part, the acquisition brings more software and additional $4 billion in ARR and a chance to grow Splunk's business, particularly internationally. Our initial research shows joint customers are generally positive on the deal, in particular with respect to Cisco's expanded portfolio in security and observability. Hello and welcome to this week's Wikibon Cube Insights powered by ETR. In this special Breaking Analysis, Eric Bradley of ETR and I will share the results of ETR's flash survey assessing joint customer perceptions and likely spending actions as a result of the Cisco acquisition of Splunk. Eric, good to see you, my friend. Thanks for coming on. Always great to be here, thank you for having me. Yeah, you bet. Okay, before we get into the survey, let's set the table with the recent rocky journey of Splunk. So what we're showing here is a five year chart of Splunk in the blue and the Nasdaq in yellow. Let's go back to 2019. That's the year Splunk acquired SignalFX in an effort to accelerate its pivot to the cloud observability in a subscription model. As you can see, prior to December 20th or December 2020, the street was buying into the story. Note Splunk's performance through November 2020 in the lower right, outpacing the Nasdaq by almost 30 percentage points. But then it had a really bad miss on ARR when it announced earnings in December of 2020, December 3rd, and it suspended long-term guidance. And while this was common practice at the time during COVID, Splunk had been holding firm on its pre-COVID ARR guidance, and that was a tactical error. At that point, it became clear that the first disappointment as the saying goes, would not be the last and the bears gained control as investors retreated from a company that was in transition. The stock got a bump when it was reported in February 22 that Cisco was offering $20 billion to buy Splunk and around that time, the board removed Doug Merritt as CEO and brought in Gary Steele, a CEO with experience selling companies. The pain continued, but in 2023, we started to see light at the end of the tunnel as the transition started to show up on the income statement and you can see the pop-up in price at the end of this chart as Gary Steele's handoff from Doug Merritt took hold and Splunk got $8 billion more than Cisco's rumored prior offer. And that brings us to where we are today. Now, while some voices are vocal and this is a bad thing for Splunk, as Eric and I reported in our predictions post in 2021, the spending picture for Splunk was clearly deteriorating. This chart shows the breakdown of ETR's proprietary net score methodology, which is a measure of spending momentum shown in the blue line. The green bars are spending more, the red bars are spending less, and the bright red is churn. And Eric, as we called out two years ago, competition and transition were not friends of Splunk. The point is Cisco in many ways represents a lifeline and avoids Splunk's board having to do a heavy lift. Eric, your thoughts on all of this. Yeah, there's a lot there. First, I want to state we also called this Cisco large acquisition and security in one of our predictions posts. So it's very hard to get one of those right. So a little kudos to you and I, Dave. But also about the stock price, amazing that they were able to get $8 billion more. One of the things that concerns me is that a 4 billion in annual ARR, it's going to take Cisco a very, very long time to recoup that money. However, as we're going to dig into soon, there's a lot of potential synergies here and overall the sentiments skewed positive among their client base. Another thing that I think we should just talk about a little bit is the Splunk data completely spot on. We've been catching a downward trend, deceleration and spending intentions for quite some time, particularly in what we call the analytics big data sector. It's really starting to drop. This sim is holding up a little bit better, but the amount of competition in that space is just overall grueling and it's going to get worse. I think the real key here is a combined entity is not only integration, but then innovation on top of it. These two combined entities really need to take all this data telemetry they're now going to have and turn it into a great XDR if they're going to be able to compete with the other competitors in their space. Alex, bring back this slide because while it shows a worrisome spending deceleration in the blue on Splunk's combined platforms, the yellow line, which represents pervasiveness in the data set, it's held up pretty well although it's beginning to wane. So the Cisco acquisition comes at the right time. Okay, so let's get into the customer analysis. First, let's look at the overlap of Splunk accounts and Cisco accounts over time. And Eric, I wonder if you would take us through this time series chart and what we're looking at here. Yes, certainly. So what we're looking at in this first slide is what we call our proprietary shared accounts analysis. And what we do is we overlap citations. So on the left hand side, you would see that this was 665 different Cisco customers only within analytics, big data and security. So we kind of took out the Meraki networking, all of those type of situations. So among those 665 customers that cited a spending intention on Cisco, we also see that almost 50%, a little over 49% also were customers of Splunk. So the overlap here is fantastic. This is where we're starting to see some of the great synergies. Also from your point of the timing, this has been rising for years and in April of this year was the first time we saw a small down ticket went from 53 to 49. So the timing of this might be really good to kind of stop that acceleration from happening any further. Okay, thank you for that. And so Eric and I spoke right after the acquisition was announced and he said, hey, we could do a flash survey. So we fired up a shared doc and we came up with a number of questions that the ETR analysts and our market analysts put together. And Eric, before we get into the results explain the survey composition, the nuances and of course the caveats of the small end. Yes, so we want it to be fast, right? This is the type of thing that you can do when you're a more agile type of survey company. And I think it's one of the, you know the great prowess of ETR. So for that reason, we weren't looking for an end of 3,400 but what we can do and which I think is really cool about this survey is the 66 people we cited and we did it in less than a day are customers of both Cisco and Splunk. And we were able to do that very quickly and we were also able to do it across only large enterprises which we categorize as 1,200 or more employees. So overall, the caveat to the survey is it's not the largest citation in the world. You know, our quarterly surveys capture, you know 16, 1700. So it wasn't meant to be the broadest but it was meant to be targeted. So these are large enterprise customers of both Cisco and Splunk. I don't know who else we could have gotten a better early reaction and sentiment gauge from. Yeah, it's predominantly North America. There are I think 10 international citations. Okay, let's get into the results here. These joint customers were asked how do you view this acquisition in terms of Cisco's product suite, Splunk's product roadmap and your company's likely utilization of either company's products as a result of the acquisition. And this shows the positive plus the very positive responses. So pretty good positive momentum here for both companies or sentiment for both companies, especially Cisco and Cisco's positive sentiment increases as you filter on the global 2000. I think roughly half of the respondents for global 2000 had jumped up to almost 70%. As well, the sentiment from overseas customers again, the warning is a small end of 10, but still it's 10. But it was overwhelmingly positive. It was nearly a hundred percent. So Eric, anything you'd add to this, do you agree with that takeaway? Yeah, I do. I mean, it's certainly skews positive. There's really no denying it. It's a little bit more positive on the Cisco side to the Splunk side, but still overall it skews positive. The one interesting thing here is that actually of all the customers, the lowest sentiment was about their utilization of the company's combined. So it's good for Cisco. Little bit less so for Splunk, but still good, but the customers aren't so sure it's good for themselves. So that's something that's going to be interesting to watch. Yeah, so let's double click on that a little bit. Now, despite the positive sentiment, we wanted to understand the risk of defection. You saw in that earlier slide, the red, there was a very small churn, maybe 5%. The spending less was going up, but this data represents responses to the question, how likely are you to find an alternative to Splunk? Obviously as a result of this acquisition. And it's mostly a wait-and-see or 39% unlikely, but there is a worrisome 17% that said likely and a very small sort of matching that churn, 5% said very likely. Eric, that 5% again is about what we saw in the previous net score granularity. I didn't go through the granularity, but it's a more sophisticated than I laid out, but me, so maybe not so worrisome, but how do you interpret this data? Well, the difference here between that and when we capture just a general replacement of a vendor in our syndicated quarterly surveys, is that this was asked about specifically based on the acquisition. So that 5% is troublesome, but they're very likely to leave. So there'll be a small amount of churn, but the real takeaway here is that 39% were neutral. So the acquisitions can have no impact. And then the other 39% said they were completely unlikely to leave. So I mean, the majority of this is that, still a pretty good reaction from the customers. But yes, I think, from a headline perspective, the company needs to be aware of that 22% that said this deal is more likely to make them look for alternatives. And let's be honest, there's a lot of alternatives out there. Again, I'm gonna go back to what I really think the key to this entire deal is Cisco in the past has made acquisitions but hasn't integrated it well. They need to put that behind them. They need to make sure this integrates and then they need to innovate on top of it. I would love to see a real industry leading XDR come out of this because Lord knows they're going to have a lot of data telemetry. Great points. And that's something that Cisco can manage. They have that, I believe is in their control. Let's now look at the likely spending patterns of customers, what they expect based on this deal in terms of new products, modules or features from Cisco and Splunk and Eric, nearly half of the customers in nearly 40% said they're likely to turn on or spend more on Cisco and Splunk new products, modules or features. And I find this pretty positive with a very small percentage saying unlikely. What are your thoughts here? I agree. I mean, I think it's fantastic. I mean, basically what this is showing is that even though they're two incredibly pervasive companies, there isn't much product redundancy here. That's why it was a really smart acquisition. They're a better company together than they were standalone. And this is a very positive aspect, particularly for Cisco, because you can see the data again, skews a little bit more positively for the Cisco side than the Splunk side. But still on both sides, they're more likely to turn on new features and modules. That is all you can ask for when you make an acquisition this big. And I'll come back to the other point at four billion ARR an annual for Splunk. That's going to take seven years to recoup this cost. So they better increase that ARR. So it's a little bit less time. Okay. As we've said, security and observability, big areas where Cisco will accelerate once the deal is closed, which is going to take at least until the spring. Here's a look at what the customers see as the positive impacts of the deal. Security is the big winner, followed by investment, leverage, and then expanded observability offerings. We'll talk about that some more. And while many have positioned this as an AI deal, joint customers don't see enhanced AI capabilities as advantageous, although there is a data angle there, Eric, what would you add to this? I think you pretty much gave a good analysis of this one. I think something that's really interesting here though is the very small amount of citations on that advanced AI capabilities. This kind of speaks to the trouble that both companies were having on a standalone basis. So to a certain extent, the game is sort of passing them by. And I don't know what they're going to do about that, but with only 22% saying that was a positive of this deal, the problem still exists, right? So the great part here is that everyone views this as an expanded security and enhanced security offering for them, which is fantastic, but they still are going to have this sort of, advanced analytics problem on their hand. Yeah, and it still gets vogue to say AI, AI, AI, as much as you can. So I get that. And I do think there's some legitimacy to the fact that Splunk has been in the data business and been doing AI for a long time, as have many, if not most software companies, but this is not specifically an AI deal. Okay, let's now look at the negatives and what concerns customers. No big shock. Customers are worried about higher prices, loss of focus, possible brain drain out of Splunk, and a smaller percentage are worried about lock in, even though they're probably pretty locked in, and dilution of innovation, and supporting Cisco's assertion of that, this data supports Cisco's assertion, that there's not a huge product overlap. That doesn't seem to be a major concern here, Eric. Yeah, the second time we've seen that, that there's no product redundancy, which I think is just fantastic of your executives of Cisco right now. So you're very likely to cause churn or lose customers based on that. But the number one concern is high prices. But the truth is that was existing for Splunk anyway. I've been capturing that in my panels and ITDM interviews for years. So I don't know if anything changes here. Anything involving Splunk has always been concerned about lock in and prices. But despite that concern about pricing, they're still incredibly sticky. And I think the question you would have to have, if you were a Cisco executive at the moment, is how much room do you have to raise pricing at this point? I think that's a question they're gonna have to test and figure out. There is a concern. And even if they do raise prices, it does seem like most customers realize that they're locked in and they're kind of okay with it, to be honest. So until something really, really intriguing comes along with a lower price and the same efficacy, I think they're gonna be okay for a while. So let's look at that. As Eric says, pricing has always been a top concern in Splunk's customer base. So we wanted to understand, drill down on that, what are customers thoughts on pricing? Nearly half of the respondents said, we don't like the pricing, but we feel locked in. Now, I mean, Splunk has a very large install base. It's got a loyal install base. Customers really, really like the product. They have processes and procedures built up around it. So hey, it's kind of like Oracle in that, in a way, this is a positive for investors, meaning the business case to stay is better than the switching costs and the risks of migration as well. The second bar here is software pricing, no matter what, it's never perfect. No matter what pricing model a company chooses, it's never gonna please everybody. And then not surprisingly, less than 10% of joint customers love the pricing model. Why would you ever answer a survey that says, oh yeah, we love the pricing? I mean, right, Eric, it's rare to say that they like the pricing. Any other comments on this data? Well, first of all, it's completely anonymous. So they did, it's not gonna come back to haunt them in any negotiations. I just wanna reiterate that to all of our ITDMs and thousands out there that contribute and thank you for what you do. Yeah, we've been hearing about this forever. This is sort of like old news type of thing. Splunk is extremely expensive and people have been looking and seeking different type of pricing models from them. I've heard people say that the problem with Splunk is they have to decide what to leave on the cutting room floor. And when you're talking about security, that's dangerous. You want to ingest everything. You want to store everything. And that's going to change. These new competitors out there have cheaper pricing, have better storage, longer record keeping. So these guys still have their job in front of them to stay relevant and stay on top with all the competition that's out there. But again, I think this move is going to make them better equipped for that than worse. Okay, the last data point we want to show relates to the Cisco and Splunk responses to a question from an Oppenheimer analyst. This was on the call. This individual asked, why did you buy a legacy company instead of an emerging company with a more modern architecture? An obvious target there would have been, for instance, Datadog in that scenario, by the way, Cisco would have had, they would have gotten 40% of Splunk's revenue and more than double Splunk's revenue growth rate, but it would have had to pay well no worth of $30 billion. Elastic is another one maybe, much, much smaller company and wouldn't have had the near-term potential of Splunk. At any rate, the response Cisco CEO Chuck Robbins and Splunk CEO Gary Steele gave basically said, look, the world is hybrid, multi-cloud and our strategy aligns with that. More than two thirds of respondents agree with these statements. Interestingly, the number one response speaks to the complexity of the hybrid approach, but it's got good value. Complexity is something that Cisco is aggressively trying to address. We've covered this in previous breaking analysis. So that's an opportunity there. 14% say it's hard and of poor value. So some work to be done there, as Eric, as you point out and then 13% say Splunk dismissed the boat on cloud. Eric, to me, this sentiment is very manageable. Like you say, they've got some work to do, but if Cisco focuses on it and they've got a competent management team for sure, and it speaks, by the way, to the challenges that Splunk would have had remaining independent. Cisco can hide a lot of those warts because of its massive portfolio. It's got great service, global coverage and it can invest in addressing some of those shortcomings with much greater resources than Splunk had available to it. Your thoughts? Yeah, I do think this is still going to be a problem as we move more towards serverless containers and those type of things. But for right now, the world is hybrid. Splunk has a great foothold in any regulated type of industry as well. So that's always gonna stay a little bit on-prem and hybrid. So I do think that the core base here is, and then look, even though some of them said that there's a little bit of complexity, we're talking about 48% of them, basically said they were satisfied and a lot of them were kind of neutral and not sure. So again, this skews positive and I think that in all large enterprises, this is a good takeaway from them. Certainly a manageable problem, but one that's going to persist, it's not going away anytime soon. So I still think there's a big road ahead of them to stay relevant, but in the meantime, they're certainly collecting a lot of cash and they are certainly a very sticky business. So I think that cash and that stickiness will help them give them some time to solve this problem. All right, let's close, summarize and look at some of the things that we're going to watch in this deal. First point is Cisco really needs a catalyst to its $4 billion low-growth security business and rather than buy a bunch of little tuck-ins, which is my friend, Zia's Caravala says, Cisco is the king of, Cisco decided to go big and this could be a nice boost to G2 Patel's security business. Remember G2 brought in Tom Gillis from VMware to help get that business going and that was a major executive hire and so this is a big, big move. Observability, which includes assets like AppD and Thousand Eyes also gets a boost. So both security and observability are data heavy businesses and with Splunk's data and analytics prowess, both of these groups can benefit from more predictive capabilities, what Eric and I were talking about before in AI. Look, while Splunk is not necessarily synonymous with AI, it's been using machine learning and AI for years and let's face it, AI starts with data. The big question is, as Eric said earlier, integration into Cisco's current business model and how it will be organized. One of the criticisms of Cisco has been its slow pace of deep integration with its acquisitions, creating more complexity. Meraki, for example, it took many, many years, like eight years before it's, even its catalyst gear could be seen on the Meraki dashboard. The deal is going to take eight to nine months to close. It's going to be another year before Cisco figures out the integration. So that's something that we'll be watching closely. We talked about the impact on the Cisco P&L and cashflow, $4 billion in new AR, cashflow are creative in year one, but Cisco promised to continue the buybacks and the dividends. They also promised to continue operating leverage. So on paper, it's a real plus for investors and Cisco has plenty of room on its balance sheet to take on a bit more debt, notwithstanding the higher interest rates. And this is a cash plus, take it on some debt deals, a cash deal, but to take it on some debt to pay for it. The other point is for Splunk to accelerate growth, it would have had to invest heavily in global expansion, which is extremely expensive and time consuming. Cisco's international footprint is massive. And with only about 15% of Splunk's business being overseas, there's a real upside there in our view. And as it relates to pricing and lock-in, those types of issues, Cisco's going to have to make the business case for staying better than migrating. And I think they'll successfully do that. One thing Eric, we didn't mention is cultural fit. I mean, our sources indicate that the initial Cisco offer and discussions weren't attractive enough for Splunk's board from their standpoint and Cisco basically said, okay, you know, let Gary Steele finish the transition, do some more cleaning up. And that turned out in hindsight to be worth an $8 billion premium for Cisco relative to what they had offered reportedly in February, 2022. And much of that work has been done. So Eric, give us your final thoughts on this deal and the things that you're looking for. I think it's a fantastic deal from Cisco's perspective, albeit expensive. Again, I think they're going to make sure they turn on new features. They have to leverage the customer base on both sides and either increase pricing or increased features and modules because this is a very expensive deal. And without increasing the ARR on the Splunk side, it's going to take a very long time. But like you said, cash flow positive, you know, so I think it's a wonderful deal for them. I'm going to reiterate that integration is the key here. There's been too many times where they've been able to acquire something, but then just sort of leave it on the vine and not, you know, bring it into the fold. It's this time they really need to bring it into the umbrella and pun attended on that one. And also you mentioned networking, I think it's really important to point out in our data that Cisco and the networking in Maraki particular is one of their better spending product lines. It's really holding up well. So the data telemetry that these two combined companies are going to have is massive. And I really think they have to find a way to leverage that and increase their security going forward. And if they can do that, this is incredibly synergistic. And I think it's going to end up being a fantastic deal for not only shareholders, but the companies and hopefully the customers themselves. Because at the end of the day, we all know those are the ones who are going to dictate whether this works or not. Let me ask you something here, because you're a former equities analyst and you know my rudimentary, my valuation style. I love to look at revenue multiple, which is only one of tiny way in which you should value companies. But I will say this, Cisco trades and I want to say four to five times revenue. And so while at four billion in ARR, it's going to take a long time to pay back, I really said seven years, pay back 28 billion from a valuation standpoint. They, if they can boost it a little bit and get, you know, five X that ARR, you know, it's not going to take as long potentially. If they can get that to let's say six or seven billion in ARR at a five X valuation, they'll make it back in valuation terms for investors. What do you think about that? I agree. I'm trying to very quickly look up what their revenue growth was, because, you know, it doesn't matter four or five times, it depends on, you know, that's all going to be determined by the pace of growth that they have. And it looks like right now on revenue growth, it was their estimated to grow only at 1% to 2024. So that four or five times for 1% growth that doesn't seem that high. And now don't quote me on that. That was a very quick look while we're doing it, but they're going to need to boost that revenue growth to maintain, you know, multiples or see a valuation lift in that multiple. But the way you're thinking about it is absolutely, you know, correct, sure. If they can use the boost revenues and there's no doubt they're going to be rewarded for it. Was that 1%? Was that Cisco's growth rate or Splunk's? That's at Cisco. Yeah, okay. I think there was an anomaly in those figures. I think Cisco is committed to, I want to say 6% or even higher. It's like mid to high. It has met 2% for 25 on the out year. But again, this is real quick. I should have had these numbers prepped, but just off the top of my head, maybe there was an anomaly or an accounting issue there. And this certainly is not factoring in the new acquisition. So those numbers are certainly going to go up and they will be rewarded for it. Now the thing is, you know, the street usually moves very quickly and the stock reaction to this was muted at best. So I think they're going to, you know, kind of approve it type of mode, at least when it comes to the equity analysts out there, because you know, we saw a huge bump 20% to Splunk's side, based on the great job they did on getting the most money possible. But on the Cisco side, as the acquirer usually is, it's a little bit muted or down. So we'll see what happens. But right now I think the street is taking a wait and see approach and making sure that the synergies are there. The integration happens and they actually do start seeing some cashflow positive and some revenue growth out of this. Yeah, Cisco lost, I want to say, $6 to $8 billion of value on the day of the announcement. So that's obviously the street viewed as somewhat negative. Although listening to the analysts' comments, they were generally positive. I mean, you know how the analysts, they want you to not spend any money and continue to grow, continue to throw off cash, don't make strategic investments, keep paying back dividends and stuff. Right, I mean, it's CEO, that's why CEO job is so lonely. All right, Eric, hey, awesome to have you. Thank you so much to the team at ETR for doing this flash survey and record time and the great, great work that you guys do. I can't say enough about the partnership now. Thank you so much for having us and anytime you need some data, just let us know. You know where to call. You bet. Okay, thanks to Alex Meyerson who's on production and manages the podcast and Ken Schiffman as well. Kristen Martin and Cheryl Knight, they help get the word out on social media and on our newsletters and Rob Hough is our editor-in-chief at SiliconANGLE.com. Thank you all. Remember, these episodes are all available as podcasts. Wherever you listen, just search Breaking Analysis Podcast. Please subscribe. I publish each week on wikibon.com and siliconangle.com. You can email me at david.volante at siliconangle.com or DM me at dvolante or comment on my LinkedIn posts and please do check out ETR.ai. They're accelerating their investments. They do so many surveys like this, like this flash survey and also an emerging tech survey that they've accelerated the pace of that in addition to the technology spending intention survey which we quote and referenced so much here on Breaking Analysis, best survey data in the enterprise tech business. This is Dave Vellante for theCUBE Insights powered by ETR. Thanks for watching everybody and we'll see you next time on Breaking Analysis.