Splunk enters new era with CEO shift

Profile picture for user slauchlan By Stuart Lauchlan November 22, 2015
Splunk CEO Godfrey Sullivan is stepping aside in favor of Doug Merritt as customer traction remains strong.

Godfrey sullivan Splunk
Godfrey Sullivan

Data analytics firm Splunk took the market by surprise late last week when it swapped out its seven-year-standing CEO Godfrey Sullivan in favor of Doug Merritt, SVP of field operations, who joined the firm from Cisco last year.

The news came hot on the heels of third quarter numbers that boasted a 50% revenue boost to $174.4 million, comfortably beating Wall Street’s expectations. But the year-on-year loss was also up, from $47 million to $73 million.

While Sullivan’s departure took the wider world by surprise, the man himself pitches the move as an orderly and timely transition as he moves into the role of executive chairman:

It's been a true honor to be a part of this place. I don't know that you lead Splunk as much as you party with it. You have to be able to hand with Splunk. It's not quite the normal leader lead company as much as it is the tribe that leads it and everybody else is a part of it.

The best part about internal succession is you already learned all products, you have learned the customers, you know the culture. [Merritt] has been out on the road non-stop for the last couple of years. I don't how many customers he met with so far and how many engineering meetings he has been in and how many QVRs. But I think he is eminently ready for the job. And the nicest part about it, I don't have to actually do much in terms of coaching because we have been working together effectively for a long time now.

I think the future is brighter than the past. Our use case is continually expanding. Our customers continue to be advocates for us. It's a wonderful and remarkable place to be. And I just think that now is a great time for a transition while business is great and velocity is good and I think Doug is exactly the right person to take us to the next chapter.


For his part, Merritt plays up what he sees as a strong inheritance to build on, citing a triple digit increase in cloud business year-on-year:

Our customers are excited with the speed and ease of Splunk Cloud. They are happy to focus their time and attention on analyzing the data to achieve their business results rather than procuring and deploying equipment. One particular win I am excited to call out is Progressive Insurance, a new customer that selected Splunk Cloud for IT ops and business analytics. Splunk will be used to improve customer experience and gain deeper insight into operational trends. Customers want to know that their workloads are as reliable and secure in the cloud as they are on-premise.

Doug Merritt

Merritt argues that Splunk has the product offering to appeal to customers whatever their preferred cloud model:

No matter what the infrastructure landscape is of a customer, heavily on-prem, heavily a cloud or any type of a hybrid, our product can follow that configuration. It is important to follow that configuration, because we are going to need to be close to that data source. So making sure that the reps approach the customer straight from the very beginning on how do we serve your needs best without pushing one way or the other, is where we are trying to keep that comp plain in their focus.

With that said, I think the growth in cloud has been a very balanced growth. We see some new customers like Progressive Insurance, as well as expansion of existing customers who might be having some type of a hybrid model, or even some customers that are moving their entire set of workloads over to cloud. And it's pretty much across the board also as far as smaller SMB accounts all the way to some of the larger accounts that we have announced in the past.

Merritt also points to Splunk’s increased traction in the public sector market, pointing to last month’s GovSummit held in Washington DC. This pulled in over 1000 government customers, he says:

For example, the US Citizenship and Immigration Services said that, "Splunk is the cornerstone that glues a lot of our technologies together so we can get fast reaction time on our data." And to quote the White House Military Office, "We use Splunk to be proactive. Since enabling, it's been a total mindset shift." And finally, Arizona State Information Security Office relies on Splunk to keep the data of their 83,000 students secure, mitigate phishing and spam and proactively identify payroll fraud.

We also had a really strong public sector quarter in terms of customer expansion. The US Postal Service used Splunk originally to support IT operations, but rapidly expanded their security when they were breached. Today, in addition to security, they use Splunk for network management, big data analytics and email monitoring. We had the Department of Energy who has signed an EAA with Splunk.


Across the wider competitive landscape, Merritt claims to have seen no major shifts:

We are still generally competing with, partnering with/competing with the SIEM [Security Information and Event Management] vendors, feeding data into, grabbing data from or in some cases where it is a brand-new by looking at us versus them.

He’s keen to emphasise that there is no competitive threat coming from Amazon Web Services (AWS):

AWS is not a competitor. We are not in competitive situations with AWS. Amazon is a customer of Splunk. It's an evolving landscape. AWS has got to serve their constituency. You never know what's going to happen, but we are the only monitoring partner with a blueprint for Lambda at AWS re:Invent. After the re:Invent show, AWS posted their own blog on the benefits of Kinesis combined with Splunk, where they actually said this powerful combination lets you quickly capture, analyze, transform and visualize streams of data without needing to write complex code using Amazon Kinesis client libraries. So I think there is great synergies with us and AWS that we will continue to work aggressively to make sure stay as synergies.

But the firm is seeing sightings of Elastic, he admits:

Elastic remains something as popping up in our accounts. You can't stop freeware and open source from being downloaded.

Our win rate is ridiculous. The overblown costs of something like Elastic become incredibly apparent. We just buildout one of their use cases and then look at the development time, the hardware cost, the operational costs and it literally is the 3X to 8X in some cases increase. So what looks like free is not free.

My take

A big change for Splunk but one that investors appear to have taken in their stride after some initial jitteriness.

What really matters is the continuing growth of the installed base with good name customers.