Thank you for standing by and welcome to Splunk's First Quarter 2023 Financial Results Conference Call. At this time, all participants are in listen only mode. After the speaker's presentation, there will be a question and answer session. To ask a question during this session, you'll need to press Star one on your telephone. As a reminder, today's program is being recorded. I would now like to introduce your host for today's program, Ken Tinsley, Corporate Treasurer and Vice President of Investor Relations. Please go ahead, sir. Thank you, operator, and good afternoon. With me on the call today are Gary Steele and Jason Child. After market close today, we issued our earnings press release, which is posted on our investor relations website, along with supplemental material. This conference call is being broadcast live via webcast, and following the call, an audio replay will be available on our website. On today's call, we will be making forward-looking statements including financial guidance and expectations, including our forecast for our second quarter and full year fiscal 2023, and our expectations of revenues, renewals, operating margin, operating cash flow, and rule of 40 scale, as well as trends in our markets and business, our strategies and our expectations regarding our business, products, technology, customers, demand, and markets. These statements are subject to risks and uncertainties and based on our assumptions as to the macroeconomic environment and reflect our best judgment based on factors currently known to us. Actual events or results may differ materially. Please refer to documents we file with the SEC, including the 8-K filing with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information. We will also discuss non-GAAP financial measures which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website. With that, let me turn it over to Gary. Good afternoon. I'm thrilled to join my first Splunk earnings call, reconnect with many of you, and talk with those of you I haven't met yet. It's been an amazing six weeks for me as I've rapidly come up to speed on the business and the opportunities in front of us. I'd first like to thank Splunk Chair Graham Smith for leading the team during our CEO transition. I recognize that such periods of uncertainty can create distractions, but this team stayed focused and drove solid execution in the quarter. I'm excited to report that we grew total revenues by 34% to $674 million and cloud revenues by 66% to $323 million, reflecting strong customer demand and bookings momentum. Jason will dive deeper into the numbers in a few minutes. I'd like to start by sharing what inspired me to join Splunk, what I've learned so far, and my initial priorities. Coming from a cyber background, I'd always admired Splunk for the role that it has played in providing the largest companies in the world unparalleled visibility that is essential to security teams to understand what's happening in their environment. Given this data-centric approach, I also fundamentally believe that there was so much more that could be done in that context, given the complexity of an ever-growing attack surface and an unrelenting threat environment. Additionally, through my discussions with the board, Splunkers and customers, I began to understand the true power of the Splunk platform and the value it's bringing to organizations that are leveraging it for observability as well as many other use cases. What I came to learn is that Splunk is the technology underpinning and powering many of the largest companies in the world. Splunk is a system of record that's deeply embedded within customers' businesses and provides the foundation for security and resilience so they can innovate with speed and agility. All of this translated to a massive, untapped, unique opportunity from which I believe we can drive long-term durable growth while progressively increasing operating margins and cash flow. Over the past couple years, as Splunk transformed itself to a cloud company, it also positioned itself on a growth path with the critical ingredients to grow from over $3 billion in ARR to $5 billion and beyond. Underlying all of this is a loyal customer base that continues to expand their usage of Splunk. For example, in Q1, our cloud dollar-based net retention was over 130%, a metric that is best in class among all SaaS companies. With the proliferation of digital and cloud transformation, security, IT, and DevOps teams are faced with an ever-evolving threat landscape, increased complexity from piling on more and more tools across hybrid and multi-cloud environments, and the silos created by all these data sources and fragmented teams that lead to inefficient detection and resolution. There is an enormous market opportunity to help customers navigate this new reality. Splunk provides insight into all data across the entire organization to ensure our customers' security, resilience, and agility to innovate. For example, a global IT services provider and new Splunk customer selected us in the first quarter for a $multi-million deal to oversee their NOC and SOC with a focus on improving security and cyber resilience. This customer, like many of our largest, saw the value in having highly scalable unified solutions for security and observability on a common platform. This three-year cloud deal replaced their legacy SIEM. As another example, a global apparel company extended their use of Splunk during the quarter with a $multi-million order. While their tech ops organization has already been standardized on Splunk for cloud-based logging and observability, their security organization was using a different security platform that lacked adequate scalability and insight into organization-wide data. The customer expanded Splunk across both tech ops and security in parallel. This decision enabled them to gain value from the same data, but for different use cases, which reduced their total cost of ownership while broadening visibility across their system. My third story is a workload pricing deal. We were selected as the best cloud-based solution for a growing financial services company serving millions of consumers. Delivering a scalable and efficient solution that provides greater visibility, we replaced their long existing SIEM provider. This deal underscored our platform's ability to consolidate customers' existing tools to reduce outages and mitigate business risks to help protect end customers. The common thread that runs through these customer stories is their unique ability to get full fidelity, real-time visibility into their data, which traverses their on-prem and multi-cloud environments at virtually unlimited scale and velocity. Our customers use Splunk to immediately realize actionable insights irrespective of the use case, be it security, IT ops, DevOps, or countless other operational challenges. Let me be very clear on this point, we offer unique technical attributes that no other company provides. Our customers deeply trust Splunk with the security of their most critical business processes, which is why we've earned the right to support broader aspects of their organization. Based on that trust, customers commit to Splunk for the long term. I look back at our 100 largest customers in each of the last 12 quarters, and on average, our retention rate with these customers is over 99%. Delivering such high value continues to earn us industry recognition. Already this year, Gartner has named us the top market share leader across security and IT operations, and the only vendor to support all three approaches to AIOps, including data and analytics tools, AIOps features, and AIOps platforms. We've also been recognized by Constellation, GigaOm, and Research in Action for leading the observability market. I've been overwhelmed by Splunkers' passion and high energy, and we have an exceptional base of talent serving our customers. I continue to meet with our teams around the world to understand our go-to-market and product opportunities. From these conversations, I see an opportunity for more streamlined processes across the company. In line with this, my first priority has been to increase internal speed and agility across our people and organizations. Flattening our org structure will help us do that. You notice that following the departure of Teresa Carlson, we did not backfill her role as president of go-to-market. Today, we're also announcing the departure of Shawn Bice, President of Products and Technology, and we will not backfill his position either. I will be hands-on with the go-to-market and product leadership teams with an emphasis on scaling efficiently where we can. We appreciate your contributions here, Sean, and wish you the best of luck in your next endeavor. Last week, we announced that Petra Jenner has joined the company as our General Manager of EMEA. Petra brings over 25 years in leadership roles with Salesforce, Microsoft, and others, and she'll oversee go-to-market strategy in the region. Welcome, Petra. We've also added our newly appointed Chief Customer Officer, Katie Bianchi, to our executive leadership team. As a tenured Splunker, Katie leads 1,200 people on our customer success and professional services teams tasked to help customers deploy Splunk and accelerate their time to value. The other top-line priorities for me are business execution and strategy. We have to know what customers need in order to execute well. I've set the personal objective with the field to meet with 100 customers in my first 100 days with Splunk. It's an ambitious goal, I realize, but it's imperative for me to get deep and broad knowledge of how our customers view our engagement, along with the value and services levels we deliver. These inputs will be critical to product and go-to-market decisions. I look forward to meeting with customers over the next several months as I travel worldwide and during our annual customer event,.conf, this June 13 through 16 at the MGM Grand in Las Vegas. Join us in person or virtually to hear our exciting product announcements and how customers like Stripe, Papa Johns, REI, Nubank, Heineken, and many other industry leaders use Splunk to stay secure and resilient as they innovate with speed and agility. In closing, I'm eager to build upon the exceptionally strong foundation that many Splunk visionaries before me have built. As our recent momentum demonstrates, this is the best time to be here at Splunk. We have an enormous opportunity to grow our business into a global enterprise software and services provider, and I'm excited to lead this team during our path to $10 billion in revenue and beyond. My sincerest thanks to each and every Splunker and all of our customers for your continued commitment. Now, I'll turn the call over to Jason. Thanks, Gary. Q1 was a good start to the year with total revenues of $674 million, up 34% over last year, and cloud revenue of $323 million, up 66%. Total revenues were significantly higher than expected, reflecting more normalization in our model, plus higher term contract volume, mostly from several very large renewals. Q1 cloud revenue was also up sharply over last year, reflecting continued customer adoption of our cloud platform. Professional services and education accounted for 7% of total revenues in the quarter. As I said last quarter, with revenue normalizing and average term contract duration more comparable on a year-over-year basis, RPO bookings is becoming a better indicator of overall bookings momentum. In Q1, RPO bookings was $491 million, up 32% over last year, reflecting strong customer demand. Our customer retention and expansion rates continue on their very impressive track, thanks to our strong product and services value proposition, as well as our customer-centric support approach. Our cloud DBNRR was 130% in Q1 and has been remarkably steady at this level since we first disclosed it several years ago. We ended the quarter with total ARR of $3.21 billion, up 30% year over year, and cloud ARR of $1.4 billion, up 60%. We had 690 customers with ARR greater than $1 million, up 28%, and 329 of these customers had cloud ARR of over $1 million, up 62% over last year. On to margins, which are all non-GAAP. Cloud gross margin was 68% in Q1, up seven points from last year as we continue to realize leverage from scale and elasticity of the platform. Total gross margin was 75%, up three points year-over-year, and reflecting a sharp improvement in cloud margin. Operating margin was -8.5% in the quarter, significantly better than planned due to our top-line outperformance and some modest expense optimization. For our EPS calculation, although it doesn't apply this quarter, it's important to note that we have adopted ASU 2020-06, which includes the share impact attributable to our convertible notes. For modeling purposes, if you estimate a GAAP or non-GAAP net income position in any future period, you should add 22.3 million shares to your fully diluted weighted average share count. Turning to guidance. For Q2, we expect total revenues of between $735 million and $755 million with a non-GAAP operating margin of between -8% and -11%. Looking further out, due to our outperformance in Q1, plus the strength of our renewal base and solid execution, we are increasing our full-year revenue expectation by $50 million to between $3.3 billion and $3.35 billion. We now expect a non-GAAP operating margin of about 2%, which is at the top of our previously guided range. We are maintaining our total ARR and cloud ARR full-year targets, and we're reaffirming our operating cash flow expectation of at least $400 million for the year. With revenue normalizing and cash flow now reflecting our change in customer and billing terms from three years ago, traditional growth and profitability metrics are becoming more meaningful. This year, we're tracking to around 35% on a Rule of 40 scale based on OCF, which is a nice step up from the 25% last year and demonstrating the earnings power of our model. In closing, execution in Q1 was solid, and we're set up for a great year. With the impacts from our business transformation mostly behind us, the growth of our business and leverage in our model are becoming clearer. With that, let's open it up for questions. Certainly. Ladies and gentlemen, if you have a question at this time, please press Star then one. If your question has been answered and you'd like to remove yourself from the queue, please press the pound key. Our first question comes from the line of Kash Rangan from Goldman Sachs. Your question, please. Congratulations on the quarter, Gary. Nice to meet you. I'm curious to get your perspective on when you look at Splunk as a business and an asset. I know you've certainly talked about your ambition to get the company to $5 billion, maybe even $10 billion in revenue. What are the things that excite you the most about Splunk? If you can just expand on that'd be great. Also, this is a very interesting time in the markets. Everybody's worried about a contraction in GDP, inflation, that sort of thing. What is your overall sense as to how the Splunk portfolio could hold up in the event of a more challenging crosscurrent of labor markets, inflation rates, et cetera? Sorry for the long-winded question, but curious to get your perspective. Thanks once again. No problem, Kash. Nice to meet you. On the first part of the question, the things that really excite me here are, one, how deeply embedded Splunk is in some of the largest companies in the world. The way in which we underlie everything they're doing from a security perspective and how they're running their IT operations is incredibly impressive, and it really plays out in our dollar-based net retention. I think that we're just in a very unique position where we're delivering tremendous value, and I think there's so much more that we can do in the market. I think I'd say that was the number one thing that really got me excited when I got here roughly six weeks ago. Now, going to your question about the macro environment, one of the things that I'm personally encouraged by is that while there's lots of turbulence and a number of factors in the macro environment, the reality is that given the security environment that we're living in with increasing concerns about what might happen relative to Ukraine, the continued concern about ransomware and other issues, Splunk sits right at the center of providing the visibility that security organizations need to understand what's happening. While there could be less than favorable market conditions, we're really mission critical in the value that we're delivering. You extend that more broadly to the underpinning of all their critical apps. I think we're in a very good position to weather whatever storm might be ahead. Wonderful. Congrats, and look forward to the journey ahead. Thank you so much. Thanks, Kash. Thank you. Our next question comes from the line of Brent Thill from Jefferies. Your question please. Gary, welcome. Congrats on the role. During the quarter, the license component was very strong versus cloud. I'm just curious if you could walk through perhaps what you saw on that. For Jason, maybe if you could just address the security versus non-security components of the story. I would assume the security business continued to do very well like your peers have been doing. Can you talk about the non-security aspects of the business? Are you seeing the same level of strength there? Any color would be helpful. Thank you. Yeah, I'll start, and I'll let Jason jump in here. From a mix perspective, we saw strength both in cloud and in on-prem. We're seeing many of our large customers work through the details of a migration to cloud. As we look across the whole year, we're very much encouraged by the level of momentum and interest we see there. I'll let Jason speak to some of the specifics as it relates to the exact number. Yeah. In terms of the security business, consistent with prior periods, it continues to be around 50% of the business. It is, you know, the fastest growing part of the business, at least on a dollar basis. I would say that the remainder of the business, which is really IT observability platform, those businesses continue to do well. Security is still the largest percentage of the business. Thank you. Thanks, Brent. Thank you. Our next question comes from the line of Brad Zelnick from Deutsche Bank. Your question please. Great. Thank you very much, and congrats as well on the strong print. Welcome, Gary. You know, Gary, just related to how deeply embedded and strategic you see Splunk being to its customers, I wanted to double-click a bit more on the leverage that you see in the model and the potential you see there. Because you talked about the efficiency and productivity of the investment Splunk makes, and I think your reputation along these lines precedes itself. We got the examples of maybe not backfilling some of the roles and departures, but anything else you can share would be really helpful. Thanks. Yeah, a couple things. One is the role that we're playing for these mission-critical customers and the role that Splunk plays. It puts us in a really unique position where there's tremendous future opportunity. As we think about the long-term model here, and I indicated this in the prepared remarks, I do believe that we have tremendous opportunity for long-term durable growth, but importantly, increasing cash flow and cash flow margins overall, operating margins overall. I think there's efficiencies to be had in the organization. You know, as I indicated, we're taking a first step by flattening the organization. I think that's one step forward in helping us operate more efficiently with more agility, with more speed in decision-making. I think over the long haul, that does translate into a lot of financial benefits for our shareholders. Excellent. Thanks so much. Thanks, Brad. Thank you. Our next question comes from the line of Raimo Lenschow from Barclays. Your question please. Thank you. Gary, good to talk again. My question was, if I listen to you today, it's obviously as a new CEO, it's like your first conference call around Splunk's. There seems to be a little bit more focus on security. Can you maybe talk a little bit about what, you know, how penetrated you see Splunk, like, you know, you can bring a kind of security lens to it? And also like, you know, how much of that is, kind of, due to the fact that in these more volatile times, we have obviously the situation that, you know, security spending will probably still be prioritized over other areas. Just a little bit of your take on that one. Thank you. Yeah, it's a really good question. Nice to talk to you again. I believe coming from a cyber background that Splunk has always had a very unique position, but I also believe there's more that we can do to create a tighter partnership with customers and ultimately derive more value from the security buyers. I'm personally very optimistic given the role that we play today and how we're positioned in those customers. To your point, I fundamentally also believe that security will be much more resilient than other things, other areas if there's more turbulent economic conditions. I'm really excited about the opportunity, the role that we play, and the fact that we're giving customers visibility they can't get from any other set of capabilities. That uniqueness for me gets me very excited about the future and the role that we can play with security. I think what you're hearing partially is my voice just coming from a security background. I think we can elevate and emphasize some of those things within Splunk, and there's short-term opportunity there. Yeah. Then one follow-up for Jason. If I look, the question I'm getting from investors is around cloud and, you know, like, you know, software companies are doing beats and raises. Well, if you look at your quarter, like cloud was kind of reconfirmed. Is there anything that you want to point out in terms of from a macro perspective that you're seeing there? Is it just kind of early in the year? Just what's the take on the guidance, on the different drivers for the guidance? Thank you. Sure. Yeah, I would say first as it comes to cloud, very happy with the performance in Q1. Cloud mix at 57%, was just up a tick over a year ago. You know, but really the motion for our cloud business really is tied very much due to the renewal base, and our renewal base is the smallest in Q1, and it really starts to go throughout the year. I would call, you know, we did reaffirm cloud guidance for full year at you know, reaching the $2 billion number, which, you know, puts us in a pretty unique place, and already implies strong growth. We do expect, as you see the cloud mix grow throughout the year, I think we said last quarter and no change for our assumption that we expect cloud mix to be approaching 70% by year-end. We'll continue to see strength in the cloud business. Perfect. That's super helpful. Congrats from me and all the best, Gary. Thanks, Raimo. Thank you. Thanks, Raimo. Thank you. Our next question comes from the line of Phil Winslow from Credit Suisse. Your question please. Hey, guys. Thanks for taking my question and congrats on a great start to the year. Gary, very excited to be working with you again. Yeah, Phil. Thanks. Gary, we'll start with you. Obviously, we've had a lot of questions on this call about security, but, you know, the other Splunk built solution on top of the platform, Observability. Wondering if you could give us just sort of your view on what Splunk brings to the secure Observability market relative to some of the competitors, what really stood out to you, and how sort of the integration of all those acquisitions coming. Got a follow-up for Jason on the numbers. You got it, Phil. One of the things that has been really interesting to me is to see the leverage that we're getting from these traditional security customers into Observability. The market opportunity is very simple in that when something goes bump in the night and there's an application failure, companies wanna know, is that a security issue or is that just an application failure? It's really looking at a lot of the same data. We benefit from being able to have that insight. Through that leverage, we're seeing lots of interest extending logs into metrics and traces to have a broader, a full view of what's happening from an Observability standpoint. I feel like there's tremendous leverage. To your point, relative to product, we're really the only vendor today out with logs, metrics, traces all integrated. Our progress on that has been tremendous. While we're still early in the market, we had some very nice wins in the quarter, and we're seeing the leverage that we have extending our footprint with the platform into the traditional observability market. We feel really good about that positioning, and I think it represents a really nice growth opportunity over the coming years. Yeah. Jason, question for you. I often get this question on the DBNRR number in the cloud, obviously, super strong, and you still have continued growth in the non-cloud ARR base. How much of that cloud DBNRR growth is coming from people sort of lifting and shifting from on-premise? Is that still the vast majority, just call it net new, in other words, a clean sort of apples to apples DBNRR number? Yeah. I mean, so overall, our overall DBNRR is growing, you know, within a few hundred basis points of the cloud DBNRR rate. That's been consistent for a while. If you then unpack how much of the cloud business is growing kind of on a durable basis without migrations, you know, it's a little harder to figure that out, but our analysis indicates that it's maybe a couple hundred basis points of tailwind, but not a material impact on the overall DBNRR number. Got it. In other words, the growth dynamics are sort of dependent on the cloud itself versus, you know, migration. Great. That's right. Awesome. Thanks, guys. Keep up the good work. Thank you. Thanks, Phil. Thank you. Our next question comes from the line of Keith Weiss from Morgan Stanley. Your question please. Thank you for taking the questions. This is Sanjit Singh with Morgan Stanley on for Keith. Gary, congrats on the role. I'm really looking forward to working with you again. I have two questions, one for Jason and then one for you, Gary. Jason, on the guidance, I was wondering if you could walk us through maybe some of the underpinnings of the assumptions around guidance with respect to closure rates or any other sort of metrics, and to what degree did you provide an extra layer of conservatism or prudence, just given all of sort of the macro uncertainty that's going on in the market. Walk us through those assumptions. For Gary, the question is really around what you sort of see the opportunity on the go-to-market side. You talked about flattening the organization. In terms of how fast should Splunk move to cloud versus continue to make this more of a choice for customers, what's the right balance for that when we think about the context of trying to improve operating margins and cash flow, sort of the pace of how this transition to cloud? I'd love to get your at least your initial thoughts on that dimension. Okay. On the first question, I'm not gonna be able to unpack it probably to the level that you'd like for modeling, but I will tell you there's kind of 4 primary pieces. You know, as we look at either whether it's ARR or net new ARR or income, you know, ACV, whatever, we start with an overall renewal rate, which we've, you know, consistently had at a very high percentage in the 90% range. We factor in what is our expectations on expansion. As you've seen with the DBNRR, that number's been relatively consistent. We then have to layer in the new logo expectations, which that's probably a little harder to do, especially if there is a slowdown in macro. Then lastly, expectations on churn, which is, you know, I guess kind of the inverse of that renewal rate. That's usually been a pretty consistent single-digit percentage number. Across all those dimensions, we're not really seeing big changes, which is why we're reiterating the guidance and didn't change the numbers for full year. You know, if something changes, we'll let you know. At this point, you know, we feel very good about the Q1 we delivered with a strong DBNRR, the RPO bookings of 32%, the revenue growth, highest revenue growth we've had in three years. Overall, feel like the fundamentals are in very, very good position. To the other part of the question, you know, one of the interesting things to think about is the way in which our largest customers want to deploy. One of the things I've learned in my six weeks here is we see tremendous value in being able to support customers that have multi-cloud hybrid environments, which is almost every single large customer. They're operating across multiple clouds, and they continue to have significant operations on-prem. Our ability to be able to bring all that together under a single architecture, provide federated search so they can search from a single instance across all those environments, is something that's super unique. But in saying all that, it does create more complexity in what percentage it will ultimately be cloud. Because we do believe that over the long haul, these large customers will continue to maintain presence, again, in the cloud and on-prem. We're not as hung up on what that exact number is because we understand that these large, incredibly strategic customers have complex environments that they need to be able to leverage Splunk in this broad hybrid world. Now, to your question about efficiency on go-to-market side, I do believe that by flattening the organization, we can drive a level of agility and decision-making that helps us get closer to our customers, improves the customer experience, and ultimately, I think we'll be more in tune with helping them advance their architectures in this what is a very complex world, and ultimately we financially benefit from that. I'm feeling incredibly excited about the role that we can play, drive customer experience, and do it in a more efficient way than we've traditionally done it. I'm, you know, while I'm early days here, super optimistic about that. Really appreciate the thoughts, Gary and Jason. Thank you so much. Thank you. Thank you. Thank you. Our next question comes from the line of Kirk Materne from Evercore ISI. Your question please. Hi, this is Chirag Ved on for Kirk. Congratulations on a great quarter, and thanks for taking the question. Gary, maybe just one for you. Could you talk about the potential to get greater scale and efficiency through partners and, you know, how you're continuing to engage with the ecosystem to help you scale? Thanks. Yeah, no, it's a really good question, and I think it's an interesting point of leverage opportunity in the business. We've done a tremendous job of partnering with some of the largest GSIs in the world. We've seen very good early traction with the cloud players. We also obviously play in the security world with the security resellers, and so there's a variety of communities where we're playing a critical role. I think what's interesting here, and the one thing that does differentiate Splunk, is the opportunity to work with those partners where they can deliver services on the back of Splunk in these complex architectures, be it security or broader observability. It really creates a very compelling opportunity for partners, and I think we're at the beginning of that journey. I think there's a lot more we can do, and it's something that I'm frankly super excited about, diving in on and supporting the team in those efforts. I think we're very early in that opportunity. Thank you. Thanks, Chirag. Thank you. Our next question comes from the line of Steve Koenig from SMBC. Your question please. Oh, great. Thank you. Hey, Gary, congratulations on the new role. Thanks, Steve. I got two questions for you. One is about competition with the XDR vendors. You know, what's your view of the difference between XDR and SIEM other than having an endpoint agent? I'll hit you with the next one after that. Yeah. The one thing that I've seen here that I think is really important is in our SIEM world and the broad Splunk platform, we're able to take a vast variety of data to provide end-to-end visibility as to what the heck is happening in these complex environments. As the attack surface has grown, having that broad visibility is absolutely critical, whether you're dealing with Log4j, you're dealing with a ransomware issue, or you're dealing with some other vulnerability in your environment. What is missing in the XDR world, it's a limited view. Customers absolutely today require this broad visible view, and I think one of the things that Splunk got right way before I got here is not discouraging customers on data. With the workload-based pricing, getting access to all that data and making it available across multiple clouds as well as hybrid, no one else can do that. I think we're in a very, very unique position relative to the XDR players. Got it. That makes sense. My follow-up is really about the context here. You've been working in cyber for many years, and so I'm curious, your view, you know, I understand the product leverage you get from playing across IT ops, DevOps in SIEM. From a customer buying perspective, where are the security purchases dependent on IT budgets, and then where are they separate? You know, is there some difference between enterprise and smaller companies? How will Splunk's go-to-market work within that dynamic? Thanks very much. Yeah, really good question, Steve. It's interesting because one of the things that I've been seeing, and I've been doing a lot of customer meetings, and so I've really been trying to get my arms around that exact question. The thing that we see is sort of threefold. First of all, we always have a strong champion in security because of the role and the dependence the security team has on Splunk. Second, the IT teams have traditionally gotten a tremendous amount of value giving them visibility across that broader application environment. Then as these new applications have been developed, leveraging modern cloud architectures, this requirement on having broader observability is absolutely critical. We really see two primary buyers. We see CISO playing a critical role, and we see CTO playing a critical role, and they're oftentimes just working in concert with one another. That leverage is amazing, and I've seen it in lots of different customer examples, day in and day out. I think we're extremely uniquely positioned here, and it represents a tremendous growth opportunity for the future as a result. Gotcha. Great. Well, thanks, Gary, and good luck. Thank you. Appreciate it. Thanks, Steve. Thank you. Our next question comes from the line of Matt Hedberg from RBC Capital Markets. Your question, please. Great. Thanks, Gary. Congrats, and really look forward to working with you again. Thanks, Matt. I guess, you know, you guys have obviously a blue chip list of customers and have made a tremendous push with Splunk Cloud. You know, how do you think about accelerating new customer lands? You know, it's been more of a, you know, an upsell into the base. That new customer land piece, how do you think about that? Yeah. I think it comes in a couple of dimensions. I think in the world we're living in relative to the requirements around security, I think Splunk plays a critical role, and we'll continue to run the play of getting customers to adopt us as the core to their overall security strategy. I think that's one. Two is we're seeing tremendous interest on the observability side, and we're landing customers in that regard as well. We had some nice wins, a couple of which we talked about in the prepared remarks. I think that motion, I think there's more work we can do there, but I think the motion is in place. Got it. Okay. Then maybe for yourself or Jason, you know, speaking about the base, obviously, you have a large renewal opportunity this year. Can you talk about the health of the large deal pipeline and maybe some of the close rates that you saw and maybe some of the assumptions you're making for Q2? Yeah. On the renewal base, you know, is certainly the smallest in Q1 of any of the quarters this year. I'd say in terms of closing deals, pretty much we're right on track. I, you know, and in terms of we do track loss rates, not seeing, you know, there's no competitive pressure on large deals, you know, that's really driving anything. It's mostly coming down to customers timing, you know, what their needs are, whether it's a cloud migration and what their capacity needs are. You know, from that perspective, it's kind of business as usual. I'm not really seeing any real shifts there. I would say this is, you know, a pretty significant step up in the renewal base, you know, over doubling from, you know, to about $1.5 billion this year. It's gonna keep growing throughout the year, progressively each quarter. Feel like we have a great start to the year and all the indications, you know, look strong at this point. Great. Thanks a lot. Congrats, guys. Thank you. Thanks, Matt. Thank you. Our next question comes from the line of Keith Bachman from BMO. Your question, please. Hi, many thanks. I also wanted to ask two questions. Gary, I was gonna start with you on the first one. Really great to hear about your orientation on improving margin, particularly free cash flow margin. With that said, one thing you mentioned was not replacing Sean, and I wanted to hear a little bit more about what the plan there. I think there's been, perhaps some go-to-market or product development go-to-market kind of execution issues, and I would call out observability while you called out some wins. I mean, feedback from the channel on observability is that it still, you know, requires some integration work. I'm just curious as to what your plan is, if you're not gonna backfill Sean, how do you make sure that Splunk continues to innovate well, to try to capture opportunities? Yeah, no, it's a great question. One of the things I'm actually personally super excited about is rolling up my sleeves and working closely with the engineering leaders to drive higher speed, agility, and faster pace of innovation. Splunkers here have done an amazing job historically, and I think that with some support, driving decision-making, we can be in a really good position. I love to get my hands dirty and work directly with the engineering teams. I think that we're really well positioned to do that with a flatter organization. I think it's a, you know, it'll be a change, but I think it'll be a very positive change for the company. Okay. Obviously a critical one. Then my second question relates to that is the typical refrain, as I'm sure you've gathered from investors, is that Splunk is losing share to a variety of competitors that are increasingly encroaching on the space. Now, it's easy to understand how your gross retention is very, very high, but what's your take from what you've heard from customers in terms of workload retention? That is to say, you know, winning new applications or winning new logos as the previous question. Could you talk a little bit about kind of your first quarter view of Splunk and how you view the competitive dynamics and Splunk's ability not only to maintain your customers, but more importantly, to keep growing your workloads, to keep driving, you know, kind of 30%+ revenue towards that type of growth? That's it for me. Many thanks. Yeah, no, it's a good question. So in the time that I've spent here, I've probably done, I don't know, maybe 40 customer meetings. In all those customer meetings, every single one of them, we spent time talking about expansion of Splunk and new workloads where they've identified use cases where they wanna leverage the power of Splunk to try to drive additional value for them. I think that the reality is Splunk's playing in this massive market, which is, you know, estimated on our estimates, it's about $100 billion. Of course, there are other players going after that. We're uniquely positioned to continue to win these workloads, given the loyal nature of these of our customers, the new customers we're signing, and the fact that we continue to see growth in the workloads that they're putting on Splunk. I think there's obviously lots of noise in the market, but I think we're incredibly well-positioned, and I hear it directly from customers, and that's where I spent my time over my first six weeks. The only thing I would add is just to restate the net retention. I mean, the net retention down only is 130%, and then overall it's within, you know, a few hundred basis points. Call it high 120s. And that's including any competitive or anything, 'cause that's net of churn. Yeah. There may be chatter in the market, but, you know, feel pretty good about stacking up the DBNRR against anyone else, you know, at our size or close to it and feel like the numbers speak for themselves. All right. Good. Fair enough, Jason. Many thanks. Thanks, Keith. Hope you feel better. Thank you. Our next question comes from the line of Brad Sills from Bank of America Securities. Your question, please. Oh, great. Thanks for taking my question, and congratulations, Gary, on your new role and nice first quarter as CEO. Thank you. I wanted to ask about just the platform itself. There's been a lot of effort, a lot of investment made in retooling for the cloud, adding observability. Do you feel like the platform is at a place now where it needs to be, and from here it's just kind of incremental improvements on those two in particular? Or, you know, is there some other efforts here that we should be thinking about as you continue to, you know, broaden the platform? No, I think, when I look at current state of capabilities today, the one thing I'm encouraged by is the amount of progress that's been made prior to me joining. We're excited. Next week, we have some exciting product announcements at.conf, which really play into this exact question. Stay tuned on that. Wonderful. Thanks so much. Jason, one for you, please. It looks like you're kind of tracking close to that, you know, ARR margin target this year, fiscal 2023, that you laid forth a couple years ago. The operating cash flow margin of ARR is quite a bit lower at that greater than $400 million level. Is there any reason to think that free cash flow couldn't come back more meaningfully than kind of where you've got it to this year? I guess, where could we see upside potentially, with free cash flow conversion as we move through the year? Well, I would say our free cash flow conversion. I mean, I think I've talked about in the past couple quarters. There's you know, a lot of puts and takes, and certainly cloud gross margin is probably the biggest driver of because there's been a lot of complexity on migrations, which has short-term margin pressure as you get through the migrations. And then once you're past the migration, you know, you can kind of dial up elasticity when you have a better you know, better understanding on exactly what utilization looks like on a by customer basis. So in terms of getting back to the kind of 20%+ cash yield, it's definitely a question of when, not if. We don't have a specific timeframe on that yet. At some point, we'll be able to give you know, some better future guidance. The timing really is gonna be tied mostly to kind of the cloud migration and then cloud margin timing, and that's when you'll see the cash yield get to that 20%+ rate that we talked about a couple years ago. That's great. Thanks so much, Jason. Thanks, Brad. Thanks, Brad. Thank you. Our next question comes from the line of Michael Turits from KeyBanc. Your question, please. Hey, everybody. So Gary, congrats on joining the company and on the role. One philosophical one for you, I think, Gary, on pricing. Splunk been down for a while, or at least customer feedback has been that pricing is high and it's difficult, but there's structures to it, and they've made changes. Do you think they're there yet in terms of doing what needs to be done to convince customers that pricing gives them value? Then I have a broader question for, I think maybe Jason, but I'll thank Gary. Yeah, I do. Great question. The move from ingest-based pricing to workload-based pricing has been incredibly important and strategic to customers. It really now is encouraging customers to more broadly leverage their data. This is important as we think about the role that observability plays as well. It's important from a security point of view because you have broader access to all the data that you really need to have insight into. You know, I think there is some hangover. I think there's still some sting out there, but the feedback on workload-based pricing has been very, very good. As you think about cloud, you know, all the largest deals are all workload pricing. I think we've made very good progress and it's been a journey, but I think we've been making good progress on this. Great. Thanks. Then the follow-up, I guess, for both you guys, but in a way for Jason 'cause he's been through this with Splunk before. On the macro side, I mean, just now on the, you know, on another data call, those comments about consumption getting weaker in this environment. You know, Jason, you went through this in 2020, where things seemed fine at first, but in some senses got weaker at some points a couple quarters later. Are you either seeing anything or anticipating changing your tactics in any way, such as to anticipate either smaller deals, longer sales cycles, or as we're hearing from another data provider today, lower consumption rates? Yeah, that's a good question. I'll start, and Jason will have a couple comments as well. It's interesting. We watched very closely as at the close of the quarter. I joined two weeks prior to the end of the quarter, so I had the opportunity to see the dynamics of all deals as they lined up as we closed the quarter. We literally heard no one talk about changing financial priorities, budgets pulled, projects pulled. We heard none of that. Literally absolutely none of it. Now, we're obviously being cautious given the broader set of market conditions, but we saw no change in buyer behavior as we worked our way through the end of the quarter. Jason, I'll let you dive in. Yeah. On the, you know, an overall basis, you know, we did obviously take up our guidance on revenue and op margin, but we maintained, you know, ARR and cash flow. I would say from what I saw in the quarter and, you know, what we're assuming as we are now well into Q2 is not really any big changes. I think certainly what we saw a couple years ago was very pronounced and very immediate. I don't see anything like that. Our assumptions really are the growth for the balance of the rest of the year. I think the biggest swing factor we're still trying to understand is to what extent are large scale cloud migrations affected. We'll learn more about that as we progress throughout the year, 'cause as I said earlier, the renewal base really kind of steps up each quarter, really kind of peaks in Q4. So far haven't really seen any real, you know, significant macro impacts. Thank you. Thanks, Michael. Thank you. Our final question for today comes from the line of Rob Owens from Piper Sandler. Your question please. Great. Thanks for taking my question. Want to add on to Michael's question, I guess just through the lens of headcount growth and hiring and, you know, whether you're going to hire ahead or you're being a little bit more conservative, in this environment. Thanks. I would say, you know, from a CFO's perspective, we're a growth company. We have a forecast that, you know, that we're maintaining from a growth perspective. We're gonna continue to be hiring certainly on the sales capacity side. You know, we still do have a platform that, you know, we're fairly well into the process of modernizing, but there's still work to do, especially on the observability side. We're gonna be making investments in those areas, and I don't expect that to change. Anything else, Gary? No. I think, Rob, it's good to talk again. I would say when we look at the overall hiring environment, et cetera, we're being thoughtful about it, but we're not tapping the brakes at this point. All right. Thank you. Thanks, Rob. Thank you. This does conclude the question and answer session of today's program. I'd like to hand the program back to Gary Steele for any further remarks. Let me reiterate that this is the best time to be here at Splunk. As our momentum demonstrates, we are mission-critical to our customers' operations already, and there's a massive market opportunity to provide a foundation of security and resilience so customers can innovate with speed and agility. I'm looking forward to working with customers, partners, and employees to use Splunk to help reach even more mission-critical outcomes. Thank you all for your support and hope to see you at.conf. Thank you ladies and gentlemen for your participation in today's conference. This does conclude the program. You may now disconnect. Good day.