Cisco Systems Inc.’s $28 billion acquisition of Splunk Inc. represents a good outcome for Splunk and a strategic growth opportunity for Cisco.

Splunk’s painful transition to a cloud and subscription pricing model was largely through the knothole, as seen by its margins and recent profit-and-loss performance. But questions remained with respect to its growth prospects and competitiveness in the hot observability market.

For Cisco’s part, the acquisition brings more software, an additional $4 billion in annualized recurring revenue and a chance to grow Splunk’s business, particularly internationally. Our initial research shows joint customers are generally positive on the deal, particularly with respect to Cisco’s expanded portfolio in security and observability — with, however, some caveats and concerns around pricing.

In this special Breaking Analysis, we collaborate with Enterprise Technology Research’s Erik Bradley to share the results of ETR’s recent flash survey assessing joint customer perceptions and likely spending actions as a result of the Cisco acquisition of Splunk.

Splunk’s bumpy journey to cloud and ARR

Before we get into the survey, let’s set the table with the recent rocky road Splunk had to travel to get here.

Above we show a five-year chart of Splunk (blue line) and the Nasdaq (yellow line). Let’s go back to 2019, the year Splunk acquired SignalFX Inc. in an effort to accelerate its pivot to the cloud, observability and a subscription model. As you can see, prior to December 2020 the Street was buying into the story. Note Splunk’s performance through November 2020 in the lower right, outpacing the Nasdaq by almost 30 percentage points.

But then it had a bad miss on ARR when it announced earnings in early December 2020. It also suspended long-term guidance. Although this was common practice at the time during COVID, Splunk had been holding firm on its pre-COVID ARR guidance and that was a tactical error. At that point it became clear that the first disappointment would not be the last and the bears gained control. Investors retreated from a company with an income statement increasingly difficult to interpret and that was clearly in transition.

The stock did get a bump when it was reported in February 2022 that Cisco was offering $20 billion to buy Splunk and around that time the board removed Doug Merritt as chief executive and brought in Gary Steele, a CEO with experience selling companies. The pain continued, but in 2023 we started to see light at the end of the tunnel as the transition started to show up on the income statement. You can see the pop at the end of this chart as Gary Steele’s handoff from interim CEO and Chairman Graham Smith (who succeeded Doug Merritt) took hold and Splunk got $8 billion more than Cisco’s prior offer, which was considered too low by Splunk’s board.

And that brings us to where we are today. Although some voices are vocal that this is a bad thing for Splunk, as we reported in our 2022 predictions post, the spending picture for Splunk was clearly deteriorating.

Splunk’s decelerating customer spending momentum was seen in the data

The chart above shows the breakdown of ETR’s proprietary Net Score methodology which is a measure of spending momentum (shown on the blue line). The green bars represent the percent of Splunk customers growing spend while the red bars show the percent of those customers spending less. The bright red is churn.

The other call-out on the chart above is the yellow line, which represents presence in the data set. That has held up well until recently, indicating the stickiness of Splunk’s installed base. But there appear to be more cracks in the armor. As we said in early 2022, competition and transition were not friends of Splunk. The point is Cisco, in many ways, represents a lifeline and avoids Splunk’s board having to do a heavy lift to remain independent.

Erik Bradley shared his thoughts on the acquisition and data as follows:

First I want to mention that we called Cisco making a large acquisition in security in one of our predictions posts. About the stock price, amazing that they were able to get $8 billion more [than previously offered]. One of the things that that concerns me is that $4 billion in ARR, it’s going to take Cisco a very long time to recoup that money. However, as we’re doing to dig into soon, there’s a lot of potential synergies here. And overall the sentiment skewed positive among their client base. Another thing that I think we should just talk about a little bit is the Splunk data. You know, we’ve been catching a downward trend in deceleration and spending intentions for quite some time, particularly in what we call the analytics big data sector. It’s really starting to drop. The SIEM [security information and event management] is holding up a little bit better, but the amount of competition in that space is just overall grueling; and it’s going to get worse. I think the real keys here for the combined entity are not only integration, but innovation on top of it. These two combined entities really need to take all this data telemetry they’re now going to have and turn it into a great XDR [extended detection and response] if they’re going to be able to compete with the other competitors in their space.

Watch Erik Bradley’s initial take on Cisco-Splunk.

Huge overlap between Cisco and Splunk accounts speaks to potential synergies

OK, let’s get into the customer analysis. First let’s look at the overlap of Splunk accounts in Cisco accounts over time. One of the features of the ETR data set is we can, in real time, create cuts like the one above. It shows a time series of the presence of Splunk accounts inside Cisco accounts. The most recent ETR survey includes 665 Cisco accounts within two sectors: 1) information security; and 2) analytics/business intelligence/big data. As you can see, the overlap is significant.

Erik Bradley adds the following:

So what we’re looking at in this slide is what we call our proprietary shared accounts analysis. And what we do is we overlap citations. So on the lefthand side you would see that this was 665 different Cisco customers only within analytics, big data and security. We took out the Meraki networking and all of those type of situations. Among those 665 customers that cited a spending intention on Cisco, we also see that almost 50%, a little over 49%, also were customers of Splunk. So the overlap here is fantastic. This is where we’re starting to see some of the great synergies. Also, from your point on the timing, this has been rising for years and April of this year was the first time we saw a small downtick. It went from 53 to 49. So the timing of this might be really good to kind of stop that deceleration from happening any further.

Flash survey to assess sentiment of joint Cisco and Splunk accounts

Right after the acquisition was announced we collaborated to construct a flash survey to gauge customer sentiment and likely behavior. Below we show the survey composition.
For this research, our primary aim was to achieve a rapid and targeted response. Leveraging the agility of ETR, we focused not on extensive respondent numbers typically seen in broader surveys but on the specificity of the sample. In under a day, ETR successfully surveyed 64 large enterprise respondents, each with 1,200 or more employees. Notably, all these respondents are customers of both Cisco and Splunk. Although the survey does not boast the vast respondent base of ETR’s quarterly surveys, which often encompass 1,600 to 1,700 participants, its strength lies in its targeted nature. It’s worth noting that the majority of our respondents are based in North America, with a smaller fraction, approximately 10, from international locations. This survey provides insights specifically from large enterprise customers of Cisco and Splunk, ensuring a focused and relevant perspective.

Joint customers generally positive on the acquisition

Respondents were asked how they view this acquisition in terms of Cisco’s product suite, Splunk’s product roadmap and the customers’ likely utilization of either company’s products as a result of the acquisition. The graphic below shows the positive + very positive responses. Overall it’s a pretty encouraging picture for both companies, especially Cisco. Cisco’s positive sentiment increases further as you filter on the Global 2000. As well the sentiment from overseas customers – warning it was a small N of 10 – but it was overwhelmingly positive at nearly 100%.

Erik Bradley weighs in on his perspective as follows:

It certainly skews positive. There’s really no denying it. It’s a little bit more positive on the Cisco side than the Splunk side, but still overall it skews positive. The one interesting thing here is that of all the customers, the lowest sentiment was about their utilization of the companies combined. So, it’s good for Cisco, a little bit less so for Splunk, but still good, and the customers aren’t so sure it’s good for themselves. So that’s something that’s going to be interesting to watch.

Erik Bradley adds color to these results and explains his takeaways on overall sentiment for the deal.

What’s the risk of defection from Splunk?

Despite the positive sentiment, we wanted to understand the risk of customers churning as a result of this deal.

The data below represents responses to the question, “How likely are you to find an alternative to Splunk?”

The most common responses are tied at 39% and can be interpreted as “not likely” and “wait and see.” But there is a somewhat worrisome 17% that said likely and a small 5% very likely.

Here’s how ETR’s Erik Bradley interprets the data:

That 5% is troublesome that they’re very likely to leave, so they’ll be a small amount of churn. But the real takeaway here is that 39% were neutral, so the acquisition’s going to have no impact. And then the other 39% said they were completely unlikely to leave. So I mean, the majority of this is still a pretty good good reaction from the customers. But yes, I think, you know, from a headline perspective, the company needs to be aware that 22% said this deal’s more likely to make them look for alternatives. And let’s be honest, there’s a lot of alternatives out there. Again, I’m going to go back to what I really think the key to this entire deal is. Cisco in the past has made acquisitions but hasn’t integrated them well. They need to put that behind ’em. They need to make sure this integrates and then they need to innovate on top of it. I would love to see a real industry-leading XDR come out of this because we know they’re going to have a lot of data telemetry.

Watch and listen to Erik Bradley’s commentary on the likelihood of churn.

How might the acquisition impact spending patterns?

Let’s look at the likely spending patterns customers expect based on this deal in terms of new products, modules or features from Cisco and Splunk. As shown below, nearly half of the customers and nearly 40% said they’re likely to turn on or spend more on Cisco and Splunk new products, modules or features respectively. This is a pretty positive sign in our view, with a relatively small percentage saying unlikely to expand spending. The results for Cisco expansion are more favorable than Splunk expansion.

Erik Bradley shares the following thoughts:

I think it’s fantastic news [for Cisco Splunk]. Basically what this is showing is that even though there they’re two incredibly pervasive companies, there isn’t much product redundancy here. That’s why it was a really smart acquisition. They’re a better company together than they were standalone. And this is a very positive aspect, particularly for Cisco, because you can see the data, again, skews a little bit more positively for the Cisco side than the Splunk side, but still on both sides, they’re more likely to turn on new features and modules. That is all you can ask for when you make an acquisition this big.

Listen to Erik Bradley’s opinion of the likelihood of expanding modules and features as a result of the acquisition.

Customers see both security and observability as beneficiaries, AI not as much

As we said earlier, security and observability are the big areas where Cisco will accelerate once the deal is closed, which is going to take at least until this spring. Below is a look at what the customers see as the positive impacts of the deal.

Security is the big winner, followed by investment leverage and then expanded observability offerings. Although many have positioned this as an AI deal, joint customers don’t see enhanced AI capabilities as advantageous.

Erik Bradley provides the following analysis:

Something that’s really interesting here is the very small amount of citations on that advanced AI capabilities. This kind of speaks to the trouble that both companies were having on a standalone basis, right? To a certain extent the game was sort of passing them by, and I don’t know what they’re going to do about that. But with only 22% saying that was a positive of this deal, the problem still exists, right? So the the great part here is that everyone views this as an expanded security and enhanced security offering for them, which is fantastic, but they still are going to have this sort of advanced analytics problem on their hands.

Erik Bradley shares his opinion regarding the tepid sentiment around AI.

What concerns customers about the Cisco acquisition of Splunk?

The following chart describes those areas where customers have the most trepidation.

It’s not a big shock that customers are worried about higher prices, a loss of focus and a brain drain out of Splunk. And a smaller percentage are worried about lock-in and dilution of innovation, Importantly, supporting Cisco’s assertion, product overlap is not a major concern.

Erik Bradley offers the following additional analysis:

This is the second time we’ve seen that there’s no product redundancy, which I think is just fantastic if your executives of Cisco right now. So you’re not very likely to cause churn or lose customers based on that. But the number one concern is higher prices. But the truth is that was existing for Splunk anyway. I’ve been capturing that in my panels and ITDM interviews for years. So I don’t know if anything changes here involving Splunk. There has always been concern about lock-in and prices. But despite that concern about pricing, they’re still incredibly sticky. And I think the question you would have to have if you were a Cisco executive at the moment is how much room do you have to raise pricing at this point? I think that’s a question they’re going to have to test and figure out. But there is a concern, and even if they do raise prices, it does seem like most customers realize that they’re locked in and they’re kind of okay with it, to be honest. So until something really intriguing comes along with a lower price and the same efficacy, I think they’re going to be OK for a while.

Listen to Erik Bradley’s analysis on pricing concerns.

Double-clicking on customer perceptions regarding Splunk pricing

Pricing has always been a top concern in Splunk’s customer base, so we wanted to further understand customer perceptions on this topic as a result of the acquisition.

As shown above, nearly half of the respondents said “We don’t like the pricing but we feel locked in.” Kind of Oracle-like and actually a potential positive for investors — meaning the business case to stay is better than the switching costs and risks of migration. As well, the second bar underscores the fact that software pricing is never perfect – there is no silver bullet answer. Not surprisingly, fewer than 10% of joint customers like the pricing model. Splunk has a large installed base that’s fairly loyal. Customers like the product. They have processes and procedures built up around it, so it’s unlikely pricing will be a reason for them to leave.

Erik Bradley provides the following additional analysis:

First of all, the survey is completely anonymous, so it’s not going to come back to haunt them in any negotiations. This is what we’ve been hearing about this forever. This is old news. Splunk is expensive and people have been looking for and seeking different type of pricing models from them. I’ve heard people say that the problem with Splunk is they have to decide what to leave on the cutting room floor. And when you’re talking about security, that’s dangerous. You want to ingest everything, you want to store everything. But these new competitors are out there and they have cheaper pricing, better storage and longer record-keeping. So these guys still have their job in front of them to stay relevant and stay on top with all the competition that’s out there. But again, I think this move is going to make them better equipped for that than worse.

Erik Bradley weighs in on Splunk pricing.

The Cisco-Splunk hybrid, multicloud, on-prem story seems to resonate with customers

The last data point we want to show relates to the Cisco’s and Splunk’s response to a question from an Oppenheimer analyst who asked, “Why did you buy a legacy company instead of an emerging company with a more modern architecture?” An obvious target there would have been Datadog Inc. In that scenario Cisco would have acquired a company with around 40% of Splunk’s revenue, and more than double Splunk’s revenue growth. But it would have had to pay well north of $30 billion. Elastic N.V. is another one but a much smaller company and wouldn’t have had the near-term potential of Splunk.

The response Cisco CEO Chuck Robbins and Splunk CEO Gary Steele gave basically said: “Look, the world is hybrid multicloud and our strategy aligns with that.”

As shown above, more than two-thirds of respondents agree with these statements. It’s interesting that the No. 1 response speaks to complexity but with good value. Complexity is something that Cisco is aggressively trying to address – so that’s an opportunity. Fourteen percent say it’s hard and of poor value so some work needs to be done there, and then 13% say Splunk missed the boat on cloud.

We believe this sentiment speaks to the challenges that Splunk would have had remaining independent. Cisco can hide a lot of the warts because of its massive portfolio and it can invest in addressing some of the shortcomings with much greater resources than Splunk had available to it.

Erik Bradley provides the following additional analysis:

I do think this is still going to be a problem as we move more toward serverless containers and those types of things. But for right now, the world is hybrid. Splunk has a great foothold in any regulated type of industry as well. So that’s always going to stay a little bit on-prem or in hybrid. I do think that the core base is solid. And then look, even though some of them said that there’s a little bit of complexity, we’re talking about 48% of them basically said they were satisfied and a lot of them were kind of neutral and not sure. So again, this skews positive and I think that in large enterprises, this is a good takeaway for them. But I still think there’s a road ahead of them to stay relevant, but in the meantime they’re certainly collecting a lot of cash and they’re certainly a very sticky business. So I think that cash and the stickiness will help them give them some time to address any problems.

Listen to Erik Bradley’s analysis on the operating model.

Integration remains a key point to watch

Let’s close with some things to watch on this deal.

The first point is Cisco needs a catalyst to its $4 billion, low-growth security business, and rather than a bunch of little tuck-ins — which as theCUBE friend Zeus Kerravala says, Cisco is the king of — Cisco decided to go big and this could be a nice boost to Jeetu Patel’s business. Remember Jeetu brought in Tom Gillis from VMware Inc. to help get that business going and this is a big move that helps Cisco’s security line of business.

Observability, which includes assets such as AppDynamics and ThousandEyes, and is run by Liz Centoni, also gets a boost. Both security and observability are data-heavy businesses and with Splunk’s data and analytics prowess, both of these groups can benefit from more predictive capabilities. Although Splunk is not necessarily synonymous with AI, it has been using machine learning and AI for years and — let’s face it – AI starts with data.

The big question is integration into Cisco’s current business model and how it will be organized. One of the criticisms of Cisco has been its slow pace of deep integration with its acquisitions, creating more complexity. Meraki, for example, took many years before its Catalyst gear could be seen on the Meraki dashboard. The deal is going to take eight ot nine months to close and it will likely be another year before Cisco figures out the integration – so that’s something to watch out for.

We talked about the impact on the Cisco P&L and cash flow – $4 billion in new ARR, cash flow-accretive in year one, continuance of buybacks and dividend and a promise of continued operating leverage. On paper this is a real plus and Cisco has plenty of room on its balance sheet to take on a bit more debt in this cash-on-hand-plus-debt deal.

The other point is that, for Splunk to accelerate growth, it would have had to invest heavily in global expansion, which is extremely expensive and time-consuming. Cisco’s international footprint is massive and, with only about 15% of Splunk’s business being overseas, there’s real upside there.

As it relates to pricing and lock in and those types of issues, Cisco will have to make the business case for staying better than migrating and we think they’ll successfully do that.

One thing we didn’t mention is cultural fit. Our sources indicate that the initial Cisco offer and discussions weren’t attractive enough from Splunk’s standpoint and Cisco basically said, “OK, let Gary Steele finish the transition and do some cleanup.” And that turned out to be worth an $8 billion premium for Cisco as more of that work has been done.

Erik Bradley shares his final takeaways as follows:

I think it’s a fantastic deal from Cisco’s perspective, albeit expensive. Again, I think they’re going to make sure they turn on new features. They have to leverage the customer base on both sides and either increase pricing or increase features and modules because this is a very expensive deal. And without increasing the ARR on the Splunk side, it’s going to take a very long time [to recoup $28 billion]. But like you said, cash-flow positive so I think it’s a wonderful deal for them. I’m going to reiterate that integration is the key here. There have been too many times where they’ve been able to acquire something but then just sort of leave it on the vine and not bring it into the fold. This time they really need to bring it into the umbrella (pun intended).

And also you mentioned networking. I think it’s really important to point out in our data that Cisco in networking, and Meraki particular, is one of their better spending product lines. It is really holding up well. So the data telemetry that these two combined companies are going to have is massive. And I really think they have to find a way to leverage that and increase their security [share] going forward. And if they can do that, this is incredibly synergistic and, and I think it’s doing to end up being a fantastic deal for not only shareholders but the companies and hopefully the customers themselves. At the end of the day, we all know those are the ones who are going to dictate whether this works or not.

Erik Bradley shares his final thoughts on Cisco Splunk. 

Keep in touch

Many thanks to Alex Myerson and Ken Shifman on production, podcasts and media workflows for Breaking Analysis. Special thanks to Kristen Martin and Cheryl Knight, who help us keep our community informed and get the word out, and to Rob Hof, our editor in chief at SiliconANGLE.

Remember we publish each week on Wikibon and SiliconANGLE. These episodes are all available as podcasts wherever you listen.

Email david.vellante@siliconangle.com, DM @dvellante on Twitter and comment on our LinkedIn posts.

Also, check out this ETR Tutorial we created, which explains the spending methodology in more detail. Note: ETR is a separate company from Wikibon and SiliconANGLE. If you would like to cite or republish any of the company’s data, or inquire about its services, please contact ETR at legal@etr.ai.

Here’s the full video analysis:

All statements made regarding companies or securities are strictly beliefs, points of view and opinions held by SiliconANGLE Media, Enterprise Technology Research, other guests on theCUBE and guest writers. Such statements are not recommendations by these individuals to buy, sell or hold any security. The content presented does not constitute investment advice and should not be used as the basis for any investment decision. You and only you are responsible for your investment decisions.

Disclosure: Many of the companies cited in Breaking Analysis are sponsors of theCUBE and/or clients of Wikibon. None of these firms or other companies have any editorial control over or advanced viewing of what’s published in Breaking Analysis.

Image: Feodora/Adobe Stock