Splunk (SPLK) Q2 2021 Earnings Call Transcript

Splunk (SPLK)
Q2 2021 Earnings Call
Aug 26, 2020, 4:30 p.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Ladies and gentlemen, thank you for standing by, and welcome to the Splunk second-quarter 2021 financial results conference call. [Operator instructions] Please be advised that today's conference is being recorded. [Operator instructions] I would now like to hand the conference over to your speaker today, Mr. Ken Tinsley, corporate treasurer and vice president of investor relations.

Thank you. Please go ahead, sir.

Ken Tinsley -- Corporate Treasurer and Vice President of Investor Relations

Great. Thank you, Daniel, and good afternoon, everyone. With me on the call today are Doug Merritt and Jason Child. After market closed today, we issued a press release, which is posted on our website.

Also note that we have posted supplemental material on the investor relations web page as well. This conference call is being broadcast live via webcast. And following the call, an audio replay will be available on the website. On today's call, we will be making forward-looking statements, including financial guidance and expectations such as our forecast for our third quarter as well as revenue mix; cloud gross margin; full year and long-term ARR and operating cash flow and trends in our markets; as well as our expectations regarding our products, technology, strategy, customers and markets.

These statements are based on our assumptions as the macroeconomic environment is -- in which we will operate reflect our best judgment based on factors currently known to us, and actual events or results may differ materially. Many of these assumptions relate to matters that are beyond our control and changing rapidly, including the impact of the COVID-19 pandemic on our business and our overall economic environment. Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements.

These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during the call may not contain current or accurate information. We will also discuss non-GAAP financial measures, which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.

With that, let me turn it over to Doug.

Doug Merritt -- President and Chief Executive Officer

Thank you, Ken, and thanks to everyone on the call for joining us. I hope you and your loved ones are staying safe and healthy. We delivered a strong second quarter with annual recurring revenue, or ARR, up 50% over last year. Cloud momentum continues to accelerate.

And for the first time in our history, our cloud-based products drove over half of total software bookings, far outpacing expectations and squarely confirming Splunk as a cloud-first company. This step shift in growth has put us on our trajectory to reach our FY '23 cloud mix target of 60% two years ahead of schedule. Our customers are turning to Splunk Cloud faster than ever before, thanks to its rapid time to value, high velocity of innovative features and lower total cost of ownership. The current macro environment is playing a role here, too, as more and more organizations accelerate their move to cloud-based services in response to the pandemic.

Many of the purchasing trends we saw in Q1 continued or accelerated in Q2. Although some customers remain hesitant to commit to long-term contracts, especially for larger orders, many existing customers continue to expand their use of Splunk as they realize substantial value from current deployments. They drive enhanced ROI as they expand to new use cases and the increasing shift to cloud. Splunk customers are on the front lines of the rapidly digitizing enterprise, driving cloud, IT, security and dev ops transformations to create new ways of working.

In recent months and due primarily to the pandemic, we're seeing rapid expansion of distance learning, telehealth, online retail and remote work, all generating new kinds of data and metrics and all powered by digital technologies. The acceleration of these trends leaves little doubt that we have entered the Data Age. In this new age, data is no longer a supplement or byproduct of our society. It is an essential element of high-performing organizations, governments and communities.

Data-dependent technologies shape nearly every aspect of how we work, shop, communicate and learn. Splunk is leading organizations into the Data Age with a cloud-first mindset. Hopefully, you saw today's announcement about the appointment of Sean Boyle to our board of directors. Sean brings deep experience in scaling multibillion-dollar cloud organizations, most recently as vice president and CFO at AWS, and we are thrilled to welcome him to Splunk as we continue our cloud journey.

In Q2, we announced that Splunk Cloud is now also available on Google Cloud, offering our customers increased flexibility and choice for real-time visibility across hybrid and multi-cloud environments. Since that announcement, we're seeing strong traction with a limited availability release and are working with our first set of production customers. And we continue to build on our strategic relationship with AWS with the AWS service-ready program, Lambda Ready, which recognizes Splunk's proven solutions for customers to build, manage and run serverless applications. We also rolled out a series of enhancements that extend our cloud capabilities and strengthen the foundational technologies of our unified platform.

The latest release of Splunk Data Stream Processor, or DSP, leverages the most advanced streaming capabilities from Apache Pulsar, the best-of-breed open-source software from the founders of Streamlio, which we acquired last fall. DSP 1.1 continuously collects, processes and delivers data to the Splunk platform or other destinations, on-premise or in the cloud, all within milliseconds. With DSP, we are now the only technology provider that has introduced machine learning across our full platform, including streaming analytics. Our online machine learning approaches are state-of-the-art with entirely novel approaches to deployment and ease of use, and when applied to the stream, enable customers to break the volume, cardinality and speed barriers that off-line batch processing presents.

Ultimately, our unified platform approach to machine learning enables customers greater ease with data quality and with data ingest. In Q2, we announced the general availability of Mission Control. This new security product services key SIM functionalities by providing the foundational elements to perform advanced detections and investigation, streamline security operations processes, contain and remediate threats and gain visibility across your entire security infrastructure through powerful integrations, all, of course, in the cloud. Next, our accelerated release schedule for IT service intelligence for Splunk Cloud enables us to deliver a centralized framework for monitoring and investigation in one view and enhanced service monitoring and event management features to support large-scale deployments.

Finally, Splunk has also expanded connected experience capabilities to support popular mobile device management providers, including MobileIron and VMware AirWatch to securely deploy Splunk mobile at scale and bring Splunk solutions to an increasingly mobile workforce. I'd also like to take a moment to celebrate the open source community and Splunk's increasing involvement to giving back. Splunk is now the number one contributor to open telemetry, which is the second largest project in the cloud-native computing foundation only behind Kubernetes. We have no doubt that open source is an indispensable component in the software and services world, and we continue to embrace a growing number of open-source projects within our Data-to-Everything Platform.

Stepping back, all organizations are on a journey to bring data to everything, and Splunk's mission is to remove the barriers between data and action so everyone can thrive in the Data Age. We want to be the strategic partner for our customers as they accelerate their digital transformation initiatives and shift to hybrid and multi-cloud environments. Here are a few highlights in the quarter. We are honored to see a marquee global 100 company dramatically increase our Splunk footprint to help accelerate their digital transformation.

This customer has been a longtime beneficiary of Splunk's incredibly powerful indexing and search offerings in the cloud. And as the impact of COVID was felt, they saw a significant increase in demand to their online channels and digital properties. Renewing this portion of the Splunk offering using workload-based pricing provide the customer with flexibility, confidence and clarity during unexpected growth, while Splunk Cloud provided unparalleled scalability and performance. In addition, to support their deep commitment to consumer experience, this customer chose Splunk and our unmatched capabilities of metrics, traces and logs to provide observability across their digital channels for the highest quality digital consumer experience.

Their increased commitment to a broader swath of our portfolio further cemented Splunk as their Data-to-Everything Platform. Secondly, serving nearly 400,000 students, Chicago Public Schools is the third largest school district in the United States. They've been a Splunk Cloud customer since 2015, and with the emergence of COVID-19, recently further expanded on Splunk Cloud to help support their shift to remote learning. With cloud, Chicago Public Schools improved their visibility into remote learning challenges, help to better serve both students and teachers across the Chicago metropolitan area.

California Polytechnic State University San Luis Obispo, or Cal Poly, expand their use of Splunk Cloud and Splunk Enterprise Security so they could better address increased phishing activity brought on by COVID-19. Cal Poly is training their students on Splunk to take the lead as first responders and protect their virtual campus, allowing them to review suspicious emails, block compromised portal accounts and resolve malicious attacks, all in only a few hours. Yale New Haven Health System ranked among the top hospitals according to U.S. News & World Reports America's Best Hospitals listing, became a new Splunk customer after trialing our Remote Work Insights offering.

Now Yale New Haven Health System can leverage the power of Splunk Cloud and Enterprise Security to combat threats with advanced analytics at scale. These impressive customer wins underline the importance data plays as organizations scale their virtual environments. We're staying tightly connected to our customers and partners and are confident we're making all the right moves to meet their needs in an ever-evolving Data Age. In closing, I'm proud of our Q2 performance and want to thank our customers and partners for their continued commitment to Splunk and our Data-to-Everything Platform.

And I want to explicitly thank by over 6,000 Splunkers for their passion, creativity and empathy and doing what's right for our customers and, just as importantly, for each other. We're looking forward to seeing everyone virtually at .conf20 in October, where we'll be engaging with tens of thousands of our most passionate customers and sharing our latest product innovations. I'll now hand over to Jason for more on Q2. Jason?

Jason Child -- Senior Vice President and Chief Financial Officer

Thanks, Doug, and good afternoon, everyone. Thanks for joining us. In the face of continued uncertainty and volatility from COVID, our execution in the quarter was strong as we surpassed well over $0.0.5 billion in cloud ARR. With today's report, we're making a hard pivot to cloud-based metrics to evaluate our performance going forward.

At a high level, we're phasing out TCV-based metrics, which were better suited for our legacy perpetual model, and replacing them with SaaS indicators. In our eight-year-plus history as a public company, we have maintained exceptional renewal and upsell rates, which are the result of delivering high value and customer satisfaction with our products and services. In a cloud model, these buying trends are best captured in a retention or expansion rate. Our trailing 12-month dollar-based net retention rate for cloud has been consistently above 130% and was 132% in Q2.

And for your reference, prior period rates are included in the supplemental slides. As Doug said, customers are accelerating their adoption of Splunk Cloud. In Q2, cloud contributed 53% to total software bookings compared to 36% in Q2 last year and 44% in Q1. In the first half of this year, cloud mix was 50% versus 32% in the first half of last year.

We believe the momentum in cloud shift is sustainable, and we're pushing the transition to cloud even faster as we now plan for cloud mix to reach 60% this year, which is a milestone we had originally planned to hit in FY '23. In a rapidly transitioning term to cloud model like ours, revenue growth is muted as upfront term license revenue is replaced with ratable services revenue over time. So ARR and RPO are better growth metrics to assess the overall bookings momentum in the business. We ended Q2 with cloud ARR of $568 million, up 89% year over year, which you'll see from the slides is an acceleration in growth rate over Q1.

Total ARR was $1.93 billion, up 50% from the year-ago period. We ended with total RPO of $1.75 billion, up 42% over Q2 of last year. And the portion of RPO, which we expect to recognize as revenue over the next 12 months, was just over $1 billion at period end, accelerating to 37% growth year over year. To better align with our cloud model and give you a better sense of the recurring nature of our customer engagements, we are retiring the TCV-based customer account metrics and moving to an ARR-based number.

We ended Q2 with 396 customers with ARR greater than $1 million, which compares to 274 in Q2 of last year, and a 4-quarter look back of this metric is also included in the supplemental slides. Turning to the P&L. Second quarter total revenues were $492 million, down slightly year-over-year reflecting substantially higher cloud mix. Cloud revenue was $126 million, up 79% over last year.

On gross margin, the high growth in our cloud business continues to drive improving leverage in our overall cost structure. Non-GAAP cloud gross margin was 59% in Q2 compared to 53% last year, with continued progress toward our 70-plus percent target next year. Total non-GAAP gross margin in Q2 was 78%, down on a year-over-year basis due to the greater proportion of revenue contribution coming from cloud. Non-GAAP operating margin was negative 13% in Q2, which was in line with plan.

On the balance sheet, during the quarter, we completed a convertible bond offering and placed roughly $1.2 billion of seven-year notes. We utilized the majority of the proceeds to repurchase a portion of the 2023 notes, which flattened the maturity towers of existing debt due within the next five years. We opportunistically added some cash and ended the quarter with approximately $2.1 billion in total cash and investments. Turning to guidance.

It's important to highlight that the fundamentals of the business remains strong, and we're confident in our ability to deliver continued high growth over the long term. Given current visibility, we are maintaining our total ARR growth targets of mid-40% this year and a three-year CAGR of 40% through FY '23. On the income statement, our outperformance on cloud mix relative to plan continues to drive variability in our revenue and operating margin targets. Just as we saw in Q1 and Q2, total revenues in Q3 are expected to be relatively flat on a year-over-year basis or between $600 million and $630 million depending on cloud contribution.

Increasing cloud mix will continue to put pressure on our margin, as well as we expect non-GAAP operating margin of between 2% and 5% in Q3. Current year operating cash flow is tracking ahead of plan, and we now expect it to be slightly better than last year. Operating cash flow should turn positive in FY '22 and will reach the $1 billion target in FY '23. In closing, our cloud transition is substantially ahead of our plan, and we're leveraging current trends to accelerate it even faster.

With cloud ARR now over $0.5 billion and total ARR nearing $2 billion, with both growing at high rates, we are rapidly building one of the fastest-growing SaaS businesses at scale. With that, let's open it up for questions.

Questions & Answers:

Operator

[Operator instructions] Our first question comes from Kash Rangan with Bank of America. Your line is open.

Kash Rangan -- Bank of America Merrill Lynch -- Analyst

That's an unbelievable quarter. Congratulations to the Splunk team. Doug, clearly, the business is hitting a tipping point at scale. It's rare to see a software company of your size grow this rapidly while pivoting to the cloud and manage all these transitions.

So much appreciated. The question for you is, as you look at digital transformation, how strong are the tailwinds for digital transformation as it relates to your cloud business? And how sustainable is this cloud growth rate? And one for you, Jason, very quickly. Can you revisit very briefly how we get to the $1 billion in cash flow? And what are the levers? And what are the assumptions behind getting to the $1 billion in cash flow in fiscal '23? That's it for me.

Doug Merritt -- President and Chief Executive Officer

Thank you so much Kash, thank you, as always. Yes, there's no doubt that the macro environment is helping propel our cloud transition. However, we all have seen this quarter other pure SaaS plays that saw flat or decelerating cloud momentum while we went from low 80s to 89%. So there's got to be more at play besides just the macro.

There's a handful of things that are really helping us right now. I think our willingness to step up big with $1 billion-plus investment in absorbability. And you all know that our absorbability suite is cloud-only, certainly is helping there. We've been very, very pleased with the continued progress and success of what we're doing within observability.

Our continuous focus on portfolio expansion and adding elements like streaming to the portfolio, I think, is another nice tailwind for us. And our teams, I just want to call out the human execution. As you can all imagine, in this environment, while there's a lot of going reports, there's a lot of businesses under a lot of pressure. And there is increasing scrutiny on spend, increasing hurdles, and seeing our teams continue to put their heads down and push through this environment so we can help our customers, I think, is an element to that as well.

Jason Child -- Senior Vice President and Chief Financial Officer

Kash, on the $1 billion cash flow question, I'd just say at a high level, the way we're going to get there is really just by returning to where we've been in the past. So before we made the ratable or invoicing change, where we started collecting annually instead of upfront, which, since our average contract is just shy of three years, what that means is we're only right now getting roughly -- when we started this last year, roughly about one-thirds of the cash upfront versus three-thirds, which we were getting before. We will stop lapping that change by middle of next year. We started it last year and moving from one to three years -- or from three years down to one year collection means it takes us two years to lapping.

And so when we come out at the other side, which will be in Q3 of FY '22, the inflow will then be right back to the level it used to be. If you go back in history, I think it was 2013 through '18, we had cash yield as a percentage of revenue. It was actually between 20% and, I think, 24% in every one of those years. And so if you look at our ARR targets, and I think Kash, you should be looking at as a percentage of ARR as opposed to revenue because of the revenue recognition differential, when you apply that 20% to our ARR target by '23, you get to roughly $1 billion.

So take the 20% on the roughly $4.5-ish billion ARR by end of FY '23.

Kash Rangan -- Bank of America Merrill Lynch -- Analyst

Real standard compared to pure-play monitoring tools that are a fraction of your size, but you outgrow them. Thank you so much. Congrats.

Operator

Thank you. Our next question comes from Keith Weiss with Morgan Stanley. Your line is now open.

Keith Weiss -- Morgan Stanley -- Analyst

And also congratulations. It's really nice performance in what is still a very difficult spending environment out there. And it's really great to see that transition to the cloud taking place so aggressively. So two questions around that.

One, I understand the environment is helping sort of push more people to the cloud, the observability suite. Is there anything that you guys are doing proactively to push customers in that direction or maybe to incent your sales guys more aggressively in pushing people to the cloud? Number one. Second question is now that we're getting to that 50% target so much earlier, does that have any impacts on sort of the model and how we should be thinking about the progression over the next couple of years toward that sort of end state -- maybe not end state, but toward that 40% CAGR and that $1 billion cash flow target? Are there any impacts on sort of how we get there or sort of the shape of the curve?

Doug Merritt -- President and Chief Executive Officer

Why don't I kick off on the more qualitative aspects. As we said in past calls, we have been modifying year over year the commission plan to initially, we're just trying to make the ratable vehicles at least on parity with perpetual, then we eventually got to the point where perpetual is less desirable, but we were trying to keep cloud in term neutral. And this year, we made cloud more attractive than term. We have seen, without a doubt, that it's significantly better for our customers when they're deploying cloud.

Their time to value is decreased dramatically. The velocity of features, as you'd expect, on cloud is significantly higher. The proactive and far more insightful machine learning recommendations, we can drive, and our areas are pretty critical. The insights we can help them with on security and IT resiliency are really only possible with cloud.

So the reps are definitely focused on it. That said, human change management is not easy. The sales leadership team has done an excellent job, Susan; Christian; our head of enablement, Linda; and so many others to make sure that we are educating the reps what it means to sell cloud, the nuances of the cloud landscape. Not everyone in the Splunk sales team has sold cloud before in their past.

So we've got multi-pronged efforts to make sure that internally and externally, the cloud message is coming through, and we see that growth continue. Jason, why don't you walk through any of the impacts?

Jason Child -- Senior Vice President and Chief Financial Officer

Yes. So Keith, on the impact to the long-term targets, well, on ARR and cash, there really is no change to those targets since those are independent of kind of cloud mix assumptions. Revenue, of course, is affected. So the faster the transition occurs, the quicker you will see a stronger snapback in revenue growth.

So this is -- we'll wreak a little more havoc on our P&L this year, as you're seeing right now with our revenue growth, but you'll see a quicker rebound, I would say, next year and into '23, but no change to ARR and cash.

Keith Weiss -- Morgan Stanley -- Analyst

Excellent. Thank you.

Jason Child -- Senior Vice President and Chief Financial Officer

Thank you so much. Thanks Keith.

Operator

Thank you. Our next question comes from Raimo Lenschow with Barclays. Your line is now open.

Raimo Lenschow -- Barclays -- Analyst

Congrats from me as well. A quick one on -- let me stay on the cloud for one more question. If you look at your cloud portfolio, now we have Signal and Omnition on there, but we're still in the early stages. So how do you think about the further drivers for customers to kind of adopt your cloud offering as you get the new UI later this year? You have Signal on there as well, which broadens the TAM, etc.

Like could we see like an acceleration there? Like how do you think about like the sales force being more motivated and the card product getting broader? And then one question for Jason. If you think about -- like you gave us the CRPO and that accelerated, but then we kind of also calculate like a bookings number. Any puts and takes we should be aware when we do the bookings calculation? Thank you.

Doug Merritt -- President and Chief Executive Officer

Thanks, Raimo. So our targets going into FY '21 were to have a 60% of total bookings be cloud-based by the end of FY '23. I think that this rapid acceleration, as we're talking about, is multiple different items, and the observability suite is certainly a contributor to that. We have been talking about what are the additional buying center that Splunk is going to go after when you got to add new buying center.

And we continue to execute well in security and IT ops, and we love those, too. But I think this observability/app to buying center is a really appropriate add. It's adjacency. It's a close bowling pin, and I love our product and lineup there.

So that is helping to propel this cloud momentum. Achieving a three-year target in one year is exciting. There's a finite edge, I think, for us on cloud given what we do, and we talked about this for my six years of Splunk. There are workloads and there are scenarios where cloud doesn't make sense.

So I we still don't have a perfect science on this, but somewhere in that 80% to 90% range of cloud is probably where we'll see it top out. And the sooner we can get to that upper end, the better. So acceleration is good. Obviously, acceleration comes at the expense of term, which will come at the shorter-term revenue hit, but consistent ARR growth and longer-term revenue consistency as we make that transition.

Jason Child -- Senior Vice President and Chief Financial Officer

Raimo, on the bookings question, last quarter, we mentioned that we were pulling those, at least from our slides as a focal metric, primarily because they're just confusing with the transformation. And so in particular, total RPO bookings is under pressure because our duration is down. I mean you can see in term on the slide, that shows that term duration is down about seven, almost 7.5 months year on year. And that's primarily because a lot of customers are not wanting to commit to longer-term term contracts because they're interested in cloud, and so that makes the total RPO bookings number look low.

ACV, though, continues to be very, very strong, which the best translation to ACV is just ARR. And you can see our ARR continues to be very strong. And then if you look at current RPO bookings, that one is also confusing because of the cloud shift. And so when you're looking at revenue plus change in RPO, revenue, of course, under the term 606, term revenue is all recognized upfront.

And so a year ago, we had a much higher term mix. So you have much more revenue booked upfront in which would mean that if you're selling a three-year deal, you're booking all that revenue upfront, and then you're adding the change in RPO. And so the problem is with a higher cloud mix, you have less revenue, and you're not pulling in those periods of revenue that really relate to beyond the next 12 months. So that's why we really recommend just look at the two most important growth drivers are: what is the ARR growth, which is kind of the durable growth that revenue will be delivering over the next 12 months; and then how are we building more backlog and unbilled through RPO.

And so those two metrics really give you the growth picture, and that's what we're focused on.

Raimo Lenschow -- Barclays -- Analyst

Perfect. Congrats.

Operator

Thank you. Our next question comes from Brent Thill with Jefferies. Your line is now open.

Brent Thill -- Jefferies -- Analyst

Thanks Doug, a couple of questions just on the business trends you're seeing. Maybe if you could just talk to what you've been seeing throughout the quarter and kind of to now. And I think Salesforce pointed out last night that things seem like they're getting better every week, and just curious if you would agree with that statement and just in general, kind of how you look at the pipeline, how you think things are building back. And then real quick for Jason.

You made some great price pivots, seems to be resonating well. Any more color on the pricing side and how that's being accepted among clients and sales in the channel? That would be helpful. Thank you.

Doug Merritt -- President and Chief Executive Officer

Absolutely, Brent. So we definitely don't see a super clean, clear rosy picture going forward. What we saw throughout Q2 and especially toward the end of Q2 is significantly more scrutiny on any spend at all on all deals. It wasn't just any Splunk deals, a constantly changing environment of approvals with last minute approvals being thrown in unexpectedly.

There were a number of deals we saw in the quarter where our economic buyer, who in the cases I was aware of was the CIO or the CISO, significant senior exec who had budget, signed the docs and said, "Let's go," have finance and procurement tell them, "No, no." The board wants to review it. The CEO wants it reviewed again. The CFO wants it reviewed again. I think it's very Polyanna-ish for people to think that the fundamental dislocations we're seeing with COVID are not going to be felt through the economy in one way or the other.

With the chaos of the election, with stimulus variability, I think we'd all be pretty surprised if we had a super neat V, and we just were all marching toward a positive upbeat drum Q4, Q1, Q2. So we remain extraordinarily focused on diligent execution. The rigor on sales continues to go up and up and up, which I think goes back to some of my call-outs to that team. They really have kept their heads down and are doing phenomenal work to make sure that they execute the way that they need to.

And I don't anticipate a smooth and easy landscape anytime in the foreseeable future. That doesn't give us excuses on execution, right? We have power in this, but the macro environment is still something that's going to be variable, I believe.

Jason Child -- Senior Vice President and Chief Financial Officer

And Brent, on the pricing question, I would just kind of echo what we said in the past, and that is very strong receptivity because we're providing way more clarity than we've done in the past to enable customers to be able to predict exactly what their price will be as they continue to increase the data volumes that they push through Splunk. And in particular, folks have really reacted positively to the kind of instance-based pricing, so Splunk virtual core for cloud or vCPU for on-prem. And those are both very well received, very, very high acceptance rates for customers that have been offered the options that have accepted that. The second thing I would point out, though, is that is still relatively early innings because the way -- since virtually, every one of our customers is under contract and they're typically under a multiyear contract, they're not going to see the new pricing unless they are up for renewal or if they're beyond capacity.

And so since we've been in this program for not quite a year, close to it, and since the average customer contract is between 2.5, three years, think of us as being probably roughly somewhere between one-thirds to one-half of our customers have actually seen this. And so very much liking what we're seeing from customers, but I think we still have a ways to go in terms of awareness and then continuing to refine the program as we go.

Operator

Thank you. Our next question comes from Phil Winslow with Wells Fargo. Your line is now open.

Phil Winslow -- Wells Fargo Securities -- Analyst

Thanks for taking my question and congrats on just another great quarter. Sticking, I guess, with one of the things on this call of the sort of expanding beyond the index, for a lack of a better term, I wanted to focus in on DSP because we have a lot of great questions have already been asked on observability. So Doug, can you give us an update on DSP? And what are you hearing from customers in terms of sort of how they're thinking about DSP and, I guess, Pulsar now with the one-on-one release in terms of, call it, whether it be front-ending Splunk, DSP as a platform for itself or potentially even interacting with the observability suite?

Doug Merritt -- President and Chief Executive Officer

Thank you, Phil. Yes, when I think about our portfolio, and I think we've been framing this way for a couple of years now, but I just want to reiterate, I think about four different areas. The foundational area is the platform, and that is there to serve any use case with our three targets, being the other three areas of the four: the cyber team, the infrastructure management/IT ops team and the app dev/observability teams. And we view DSP as part of that platform, and the move beyond it's awesome to the index.

Still is incredibly powerful. It remains, I think, unique in the world and the industry as being the only storage vehicle that elegantly demands no upfront structuring data and still is able to provide structure and meeting with that data on -- at time of query. So that remains critically important to the portfolio, but there's more to the world in indexing, which is why we leaned in with stream processing. It's why you'll find elements like Druid in our cloud stack to help with more classic, multidimensional data.

So we view this landscape as very complex and robust. We clearly are open source-friendly at this point in time with things like Flink, Pulsar, Kafka as typical and well-mannered elements within the development team. And we view streaming as a critically important initiative for the company. It dramatically enhances and increases the scale and efficiency of the observability suite.

We are seeing petabytes of data being managed by DSP to make sure that they are highly accurate, no sample, no drop metrics and traces being extracted effectively. It clearly is a whole another platform to do processing on. Not only is there really intelligent transformations and enrichments, they're happening on the data in the stream that help reduce the size and scope of data wherever it lands. But our stream-based ML is unique.

And then there's all the orchestration, automation, interrogation, other elements on top of that stream. So it's becoming a pretty indispensable and nonelective portion of the platform portfolio, and you'll see DSP continue to get more and more wound into the different solutions that we target toward those 3 buying centers. We remain very bullish on the opportunities that observability gives us and new platform components like streaming and think that those are some of the fuel that we're seeing for our ability to continue to maintain high growth.

Phil Winslow -- Wells Fargo Securities -- Analyst

Awesome. Thanks guys. Congrats again. Thank you.

Doug Merritt -- President and Chief Executive Officer

Thank you Phil.

Operator

Thank you. Our next question comes from Matt Hedberg with RBC Capital Markets. Your line is now open.

Matt Hedberg -- RBC Capital Markets -- Analyst

Great. Thanks for taking my questions. Doug, wondering if you can comment a little bit more specifically. I appreciate your macro comments to a prior question.

But is COVID actually accelerating the adoption of SaaS? And I'm also wondering if that's also having an impact on new customer addition or new customer adoption. I know this is not a great environment for new customer adds, but curious where Splunk Cloud is being deployed. Is it within your base? Or is it actually accelerating some new customer adds?

Doug Merritt -- President and Chief Executive Officer

I do. In the macro arena, I absolutely think that COVID is accelerating cloud globally and for organizations like us. I was pretty amazed to look at -- when we look at industry activity, three industries in particular that we called in Q1 that we were tracking and wanted to make sure that we're there to help with: travel and transportation, manufacturing, retail, that they actually increased their purchasing activity with Splunk as industries between Q1 and Q2. And as we know, those three industries have not had the easiest time.

So I think that, that was reinforcement. And the direct conversations I have with customers in those categories are reinforcement that, "Hey, the only way we're going to have any chance to getting through this is we're going to have to accelerating in ways we never dreamed of our digital footprint because that's the only way we can communicate internally and externally and do the type of business that we need to or invent new lines of business." So it's a clear tailwind. Net new customers, I think, of size for most organizations are likely to be an issue. We definitely find it harder to get brand-new prospecting engagements versus being able to work with trusted sources within accounts.

That said, we had net new customers, but we had a healthy rate of net new customers equivalent to last year. Still, we have not found a way to break that baby out and have it scale like crazy like we want to. And some of those net new customers were part of the $1 million-plus ARR number. So this is something that affects organizations that are already familiar with Splunk as well as those that aren't, and we're seeing both being impacted.

Matt Hedberg -- RBC Capital Markets -- Analyst

That's great. That's super helpful, Doug. And then, Jason, really do appreciate the color and the focus on ARR and CRPO given this mix shift that we're seeing, though. And I'm wondering, obviously, you guys outperformed the cloud mix.

If that cloud mix had come in closer to where you expected relative to your Q2 guide, I'm wondering, would revenue have been sort of in line, above the high end of the range? Just sort of curious directionally how revenue would have done if mix would have been similar to kind of what you expected.

Jason Child -- Senior Vice President and Chief Financial Officer

Yes. So I mean at a high level, if you just take the TCV that we had, the total contract value in the quarter, and take 500 basis point differential in cloud mix versus what we had guided to, it translates to between $25 million to $30 million. And so I think we were about $28 million below guidance, and so we would have been right on absent the cloud aspect.

Matt Hedberg -- RBC Capital Markets -- Analyst

Great. Super helpful. I appreciate the color. Jason, thanks.

Jason Child -- Senior Vice President and Chief Financial Officer

Thanks.

Operator

Thank you. Our next question comes from Mark Murphy with JP Morgan. Your line is now open.

Mark Murphy -- J.P. Morgan -- Analyst

Yes. Thank you and I'll add my congrats. I'm interested in what you think the shape of the demand curve looks like if you were to try to split it into remote work, remote learning, use cases versus everything else. So in other words, all of the activity, which I think you mentioned more this call, Doug, particularly around a lot of the school district wins, but everything around monitoring, VPN and VDI environments that you have this package called Remote Work Insights, you have all of these new products for monitoring Zoom and WebEx types of logs, I'm trying to understand how material is that contribution.

And how would you say that is trending today versus back in April?

Doug Merritt -- President and Chief Executive Officer

So it definitely helped us with a number of organizations that had this burning need. They saw that we had something to help them. And that probably was the instigator to say, "Hey, let me switch, Splunk can do it for us." At the end of the day, the power of Splunk is the data that you are going to ingest from VPNs, from applications, from networks from -- can be used for hundreds of different options and opportunities. And so when we talk about someone like -- I think it was Yale New Haven, who got intrigued because of remote work, but then -- and deployed that, but then deployed Splunk for classic IT, overall visibility and for classic security, analytics and visibility.

That again is the power of the Splunk platform that our new pricing model finally gets us away from data volume, but it's the thing that the data volume guys missed as you pay for it once and then you get to use it in a multiple different dimension. So I think it is having a lead gen and an intrigue or engagement impact. But then ultimately, the data for the remote work capability becomes similar data to the rest of our use cases.

Mark Murphy -- J.P. Morgan -- Analyst

OK. Understood. And a quick follow-up, Jason, I was interested in whether the security mix, if you look at it as a percentage of bookings or a percentage of revenue, is it looking any different today than it did pre-COVID? Again, just trying to understand if there has been an uplift in security adoption because of the pandemic.

Jason Child -- Senior Vice President and Chief Financial Officer

It remains pretty consistently at about half of our business. I'd say maybe the slight difference would be the other half used to be IT. Now I'd say the other half is IT and observability, which is certainly growing, but that's what we've seen thus far. Thanks Mark.

Operator

Thank you. Our next question comes from Fatima Boolani with UBS. Your line is now open.

Fatima Boolani -- UBS -- Analyst

Good afternoon. Thanks for taking the questions. Doug, I'll start with you. I appreciate the detail and color around the $1 million ARR engagements that you have with the customer base.

But I was wondering if you could characterize how that sales motion is progressing. Because if I think about historically in sort of a TCV perpetual license model, the EAA format was an important conduit for some of the larger deals. So I'm wondering how that's evolving or transitioning as you do move to an ARR and ACV-based model and how that factors into how you transact in large deals and the velocity of those large deals. And I have a quick follow-up for Jason.

Doug Merritt -- President and Chief Executive Officer

Yes. I'm really, really excited about the move from TCV to ACV for a number of reasons and you combine now the cloud. I think you just wind up with a much more durable and healthy business. You could lump up TCV, get these big, big outliers that in the 606 model had a pretty big impact in the quarter, but they weren't as consistent.

What we're shifting to is, one, the default for all cloud transactions is workload-based pricing. So we're clearly beyond and away from the data volume-based pricing. And in a cloud-based mentality, an ELA, if we assume standard terminology, is a very rare and unlikely thing, right? You've got to pay for the infrastructure you consume. So the workload pricing, combined with this portfolio approach, we've got a security portfolio, an IT portfolio, an app dev portfolio or observability portfolio and then this platform portfolio, I think that ARR is the way that will continue to be driven is land with a meaningful contract that is either platform or one of those portfolios and then expand within that portfolio and make sure that security is using all the facilities, and that consumes more workloads or more users depending on the portfolio, and then begin to do the effective job of traversing other departments.

So we view that ARR figure, and that's why we wanted to make sure that we also came forward with the dollar-based net renewal rate for you guys as two really important and complementary aspects of what the field needs to focus on. Land, the drive to a $1 million-plus ARR, but that's going to come through effective renewals and the right dollar-based net renewal rate.

Fatima Boolani -- UBS -- Analyst

That's super helpful. Jason, for you, we appreciate that you're sort of coming up on the cusp of a pretty large wave of term renewal business. So I'm thinking back to '18 and '19 when the term license modality really started to kick off. So as we think about sort of fiscal '22, fiscal '23 and that stable of term renewal business, how do you see that, I guess, modulating with cloud accelerating, with existing customers opting for maybe a cloud-based procurement and consumption model? Can you help us with some of the assumptions that you're operating under as some of these conversions potentially happen in the base? And that's it for me.

Thank you.

Jason Child -- Senior Vice President and Chief Financial Officer

Thanks. That's a good question. They're all good questions, but that's a tricky one. I would say the model that we're using assumes that, yes, we have a significantly growing renewal base, which is certainly a tailwind to our ARR growth, as we've talked about in the past, and that renewal base is growing substantially really next year than even more the year after.

The percentage of those renewals that we expect to move to cloud, we think, is going to be in line with the overall cloud mix rate, which is what we've seen happen this year and maybe a little bit more accelerated than we've seen in the past. That said, it's hard to know. If the environment stays like it is now, then we'll probably see continued faster or continued acceleration toward cloud. But it's hard to determine because ultimately, we don't tell the customer what to pick.

They're going to pick whatever works best for them. I'd say from a product side, we've moved to cloud-first such that if you buy the cloud product, you are getting the latest and greatest. You're going to get updates faster. And so our view, it is a superior product, and so it's likely that folks will be moving faster to cloud.

But that's definitely one of the bigger, I guess, sensitivities as we look toward next year.

Fatima Boolani -- UBS -- Analyst

Very nice. I appreciate that. Thank you.

Operator

Thank you. Our next question comes from Andrew Nowinski with D.A. Davidson. Your line is now open.

Andrew Nowinski -- D.A. Davidson -- Analyst

Thank you. OK. Great. Just two quick ones for me.

So I know you're focused on the cloud service, but the license business is still a $1 billion business. I had a question on the pricing and the competitive landscape there. I know you made changes that made the prices more transparent to the customer, but do you think competitors like Elastic might be adding some pressure to that segment in addition to the shift to the cloud?

Doug Merritt -- President and Chief Executive Officer

That's a great question. I mean the pricing changes that we rolled out are universal. We've got an equivalent to our workload-based pricing in the cloud from on-prem customers. And I know anyone that is buying a term license is being presented with that option as well.

We have maintained very consistent win rates against Elastic, which are still very impressive win rates for all the engagements that we see and are involved in. And that competitive environment feels fairly stable there is probably the way I'd answer that.

Andrew Nowinski -- D.A. Davidson -- Analyst

All right. Got it. And then just last one for me. I know we're coming up on to a stronger U.S.

federal spending period, but I'm wondering how the U.S. Fed deals contributed to your quarter in the July quarter.

Doug Merritt -- President and Chief Executive Officer

Thanks, Pub sec team did a really nice job, as always, in Q2. Q3 is a high variability quarter. It's usually the biggest quarter for pub sec given federal year-end. There is more uncertainty and inconsistency in the pub sec environment than we've seen in a long time.

The team has got their head down and is working diligently to try and mitigate whatever the uncertainties -- whatever uncertainties they can, but this is probably the most volatile environment that I've seen in six years at Splunk. So we will wait and see by the end of Q3 what happen within that federal spending segment. And the teams, I know, the buyers are passionate and the teams are passionate about making sure that our federal agencies get access to Splunk. And hopefully, that will be allowed given all the volatility in that segment.

Andrew Nowinski -- D.A. Davidson -- Analyst

Great. Thank you.

Operator

Thank you. Our final question today comes from Keith Bachman with Bank of Montreal. Your line is now open.

Keith Bachman -- BMO Capital Markets -- Analyst

Thank you. I also had two questions. Doug, for you first. You just mentioned the net retention rate or the cloud net retention rate, which is really strong at 33 or 32 -- 133% or 132%.

What would that be for the total ARR, though? And that's the cloud ARR. Or is the reason you're suggesting that is because you have the transition mix, which skews the data set on the cloud ARR? And as part of that is, do you think that, that 133%, 132%, is that a durable type of number?

Doug Merritt -- President and Chief Executive Officer

Yes. So we actually purposely gave cloud because it is durable. The performance overall was meaningfully higher than it was in cloud, but we know that a portion of that is the benefit that we get from the perpetual and the perpetual license base moving to term, and Jason can go in a little bit more detail. But we want to make sure that we gave something that we thought it was going to be consistent going forward, and we expect the overall net retention rate to actually come down from these higher levels whereas cloud should maintain.

Jason Child -- Senior Vice President and Chief Financial Officer

Yes. I'll just add on that, because there is a higher average selling price with the hosted cloud solution versus the on-prem solution, customers moving over to cloud are going to see like an initial onetime boost. And then over time, they should be growing at the cloud-based net retention rate. So we thought showing the higher number when it's conflated by customers that are making that switch over to cloud makes it a little bit high.

The best way to measure it over a longer period of time is to look at the cloud net retention rate customers that were buying cloud a year ago, where are they today, that's exactly what we put in our slide deck, the 132%..

Keith Bachman -- BMO Capital Markets -- Analyst

OK. Well, it's a still strong retention rate. So that's great. Jason, my follow-up question is on cloud gross margins.

You've seen the transition. As you said, the cloud transition happened a bit faster. How should we be thinking about the cloud gross margins in particular?

Jason Child -- Senior Vice President and Chief Financial Officer

Yes. That's been an ongoing effort for a couple of years. A lot of progress has been made by Tim and Sendur's team, in particular on margins. So I've talked in the past about how there's a lot of work that was being done first on building a stateless architecture, so you could separate storage from compute processing and pricing.

That's step one. Most of that works pretty far along. There's also building kind of multi-tenant architecture so that we can actually focus on the best price for whatever the service is. That's probably a little bit earlier in process.

And then I think there's certainly effort also in just getting better overall terms as the size of the business increases and we're able to negotiate better discounts. And so the combination of those three things is why we're confident in being able to get to a 70-plus percent gross margin structure over time, where we believe we can hit that by the end of next year. We expect to hit above 60% by the end of this year. But that said, it's something that we started roughly two years ago.

I think we mentioned in the past that it was as low as 30%, and so it's really mostly just execution-oriented work. The reason why most other cloud businesses that you look at that are offering similar services to us are typically in the 70-plus percent range is because they've already done that work or maybe they were native to cloud and so they were built that way. But from our perspective, it's definitely not innovation work, it's execution work, and we're confident that we can get to those 70-plus percent targets in 1.5 years or so.

Keith Bachman -- BMO Capital Markets -- Analyst

OK. Great. Many thanks.

Operator

Thank you. Ladies and gentlemen, this concludes our question-and-answer session. I would now like to turn the call back over to Doug Merritt for any closing remarks.

Doug Merritt -- President and Chief Executive Officer

Thank you. Hopefully, as you all have seen by our consistent results over the past few quarters, we remain maniacally focused on the willingness to run headfirst into difficult transformations because that's what's necessary for our customers' success and to the long-term durable success of our company, and while we do that, to simultaneously stay very rigorously focused on execution so we can drive consistent results. I think we're all really pleased and excited on the Splunk side that the monumental progress we made in cloud over the past five-plus years as we started from nothing and learned a lot of lessons and I think built a very interesting business. And the macro environment is something that is a little bit out of most of our control, but the category demand is incredibly healthy.

The macro is driving some of the fundamentals that we believe we're going to manifest one way or the other, just a little bit more quickly. And I am increasingly more and more confident that the breadth and scope of our portfolio, combined with the needs of the market and our ability to both take risk and manage that risk through execution, is what's driving us to have the growth rates that we have. I would urge you guys to compare other companies at the $2 billion ARR metric, or I guess 1.925 on our side, and their growth rates. And I think you'll come with the same appreciation that I have that we are a unique standout in our ability to grow irrespective of transformation.

And then when you add in the magnitude of transformation that we've been driving, my hats are off to every single Splunker, our partner ecosystem and the graciousness of our customers to continue to support everything that we're trying to get done, and I continue to thank all of you on the call for your belief and support in us as a company.

Operator

[Operator signoff]

Duration: 61 minutes

Call participants:

Ken Tinsley -- Corporate Treasurer and Vice President of Investor Relations

Doug Merritt -- President and Chief Executive Officer

Jason Child -- Senior Vice President and Chief Financial Officer

Kash Rangan -- Bank of America Merrill Lynch -- Analyst

Keith Weiss -- Morgan Stanley -- Analyst

Raimo Lenschow -- Barclays -- Analyst

Brent Thill -- Jefferies -- Analyst

Phil Winslow -- Wells Fargo Securities -- Analyst

Matt Hedberg -- RBC Capital Markets -- Analyst

Mark Murphy -- J.P. Morgan -- Analyst

Fatima Boolani -- UBS -- Analyst

Andrew Nowinski -- D.A. Davidson -- Analyst

Keith Bachman -- BMO Capital Markets -- Analyst

More SPLK analysis

All earnings call transcripts