Splunk (SPLK) Q4 2021 Earnings Call Transcript

Splunk (SPLK)
Q4 2021 Earnings Call
Mar 03, 2021, 4:30 p.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Ladies and gentlemen, thank you for standing by, and welcome to the Splunk Inc. fourth quarter 2021 financial results conference call. [Operator instructions] Please be advised that today's conference is being recorded. [Operator instructions] I would now like to hand the conference over to your speaker today, Ken Tinsley.

Thank you. Please go ahead, sir.

Ken Tinsley -- Vice President, Investor Relations and Treasurer

Great. Thank you, and good afternoon. With me on the call today are Doug Merritt and Jason Child. After market closed today, we issued a press release, which is posted on our website.

Also note that we have posted supplemental material on the Investor Relations web page as well. This conference call is being broadcast live via webcast and following the call, an audio replay will be available on our website. On today's call, we will be making forward-looking statements, including financial guidance and expectations, such as our forecast for our first quarter as well as future expectations of revenue mix, renewals, duration in cloud growth and cloud gross margin as well as trends in our markets and our business and expectations regarding our acquisitions, products, technology, strategy, customers, demand and markets. These statements are based on our assumptions as to the macroeconomic environment in which we will be operating and reflect our best judgment based on factors currently known to us and actual events or results may differ materially.

Many of these assumptions relate to matters that are beyond our control and changing rapidly, including the impact of the COVID-19 pandemic on our business and that of our customers and the overall economic environment. Related to this uncertainty, certain customers have and may, in the future, continue to decrease or delay spending commitments, particularly for certain high dollar and long-term contracts. Please refer to documents we file with the SEC, including the Form 8-K filed with today's press release. Those documents contain risks and other factors, which may cause our actual results to differ from those contained in our forward-looking statements.

These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information. We will also discuss non-GAAP financial measures, which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.

With that, let me turn it over to Doug.

Doug Merritt -- President and Chief Executive Officer

Thank you, Ken, and thanks to everyone on the call for joining us. Q4 was a strong finish to a memorable year for Splunk. I'm proud of both our results as well as the dedication and tenacity of our team over these past 12 months and particularly during our year-end, and I'm so very grateful for the trust and commitment of our customers and partners. Splunk ended the year with overall annual recurring revenue of $2.36 billion, up 41% over last year.

Even more importantly, we saw continued impressive results in our cloud-first initiative with cloud ARR delivery of $810 million, up 83% over last year and accelerating from our growth rate in Q3. Driving our continued transition in the cloud has been our number one company priority for the past three years, and that's continuing into FY '22. We remain very pleased with the progress of our transition to cloud. Looking back in time, just four years ago, cloud was less than 20% of our software bookings, delivering $48 million in revenue.

And the upper end of allowable daily data volume was about 10 terabytes per day. Today, cloud revenue stands at $554 million, representing an 84% CAGR. We're deploying 100 terabyte plus footprints, with customers taking advantage of workload versus data ingest pricing and cloud now represents the majority of our business, with 51% of our software bookings coming from cloud in Q4. We've seen that when our customers move to cloud, the investment they make in Splunk expands rapidly as they utilize the high velocity of our cloud innovations, features and machine learning, ultimately allowing them to free up resourcing, and reorient their focus and time to what's most critical to them.

Despite the continued uncertainty and volatility in the macro environment, we had a strong finish to the year. In Q4, we saw procurement patterns that were closer to what we experienced in Q1 and Q2, and we were also able to close transactions with several of the accounts that deals slipped in Q3. Throughout the 100-plus customer interactions I've had over the past several months, I'm hearing about their continued belief in the value of our technology and seeing many of them expand their commitments to Splunk as a result. Over the past year, the world has experienced more change than in the past 10 years, and there are signs that 2021 will be similar, especially when it comes to data and to technology.

Already, we're seeing companies with a strong digital strategy outpacing their peers. The organizations that prioritize the strategic use and operationalization of all of their data will achieve significant business and economic benefits. We're also seeing cybersecurity attacks at unprecedented levels and scale. The magnitude of the SolarWinds hack has hammered home the unsettling but ever-present reality of the digital era that all organizations are likely to get hacked at some point.

Digital security has become a broad governance imperative. Splunk is working side-by-side with our customers to help them drive the change, resiliency and optimization around both of these key and critical trends. As an example, at the onset of the SolarWinds attack, Splunk took immediate action to both enable customers to investigate whether they've been impacted by the attack and to confirm that Splunk itself had not been impacted. Our customers count on us to deliver timely detection capabilities.

We did not disappoint. Our security strategy team published materials to guide our customers on how to use our products to find evidence of the Sunburst Backdoor. Our professional services and customer success teams deployed remote on-demand services to help customers implement this guidance. From there, our product and security teams released timely Splunk research and dynamic security content using the update capability in Splunk Enterprise Security to help our customers understand their own risk.

As a whole, we responded rapidly to deliver the best-in-class value that our customers and community expect from Splunk. We know that all organizations are on a journey to bring data to everything. And our mission, to remove the barriers between data and action so everyone thrives in the data age, has never been more important. The breadth and depth of our data-to-everything platform dramatically enhances the richness and value of our focused solutions for our customers across IT operations, security and DevOps.

Observability was among the standouts within our business in FY '21, fueled by customers accelerating their own digital transformations and shifting to modern application development. Our customers are clearly excited about our observability capabilities and the market is too. Just last week, industry analyst firm, GigaOM, published the industry's first ever evaluation of the cloud observability market, naming Splunk as the only outperformer and knowing that Splunk has emerged as one of the leaders in the observability space. Here are just a few examples from this past quarter where Splunk enables some of the largest and most innovative organizations in the world to do more and bring more of their teams together on a common data platform.

British grocery retailer, Tesco, is a longtime Splunk customer and the third largest retailer in the world in terms of gross revenue. Tesco recently expanded their use of Splunk, Enterprise Security and our Observability suite to better support an 80% increase in online sales brought on by COVID-19 in the run-up to Christmas. By leveraging Splunk to take action on their data, Tesco can provide their customers the seamless online shopping experience and improve delivery speed. Nationwide Building Society, the largest building society in the world, expanded their use of Splunk Cloud and Enterprise Security to ensure their 15 million members received the fastest response on protection against fraudulent activity.

Relying on Splunk is an integral part of their cloud transformation. The British mutual financial institution has already seen a significant cost reduction across all services and will be better equipped to safeguard their customers, their financial accounts and their personal data. Leading omnichannel commerce platform, Shopify, continues to expand their use of Splunk Enterprise as well as Splunk Application Performance Management, or APM, as the company transforms their observability strategy. With the increase in e-commerce and online purchases brought on by COVID-19, Shopify expanded with Splunk to address their growing tracing and application monitoring demands as well as provide them with visibility across their entire organization.

With our observability solutions, Shopify is able to scale and support over one million merchants selling their products online. Longtime customer, Okta, upgraded their use of Splunk Cloud, which serves as their data-to-everything platform across the entire business. With Splunk Cloud, Okta can better serve their 9,400-plus customers by monitoring and providing faster response times and fewer error rates. Okta also leverages Splunk to better understand customer usage patterns, enabling them to continue to enhance our customer experience capabilities.

These customer wins in Q4 underline the importance data plays as organizations scale their online and virtual environments. In summary, we delivered a strong finish to our year as we continue to deliver for our customers and execute across our multi-pronged transition. Once again, the majority of our software bookings came from the cloud, driven by cloud ARR growing at 83% year over year. With an overall $2.36 billion business growing at 41%, we are delivering best-in-class growth at scale, which is just one of the many reasons Splunk was just included among Fortune's Most Admired Companies for the first time ever.

We're excited about the year ahead and the opportunity to serve our customers with our incredibly rich technology portfolio, our industry-leading customer success and support offerings and our cloud-first footing. I'll now hand over to Jason for more on the quarter and fiscal year results. Jason?

Jason Child -- Chief Financial Officer

Thanks, Doug, and good afternoon, everyone. Thanks for joining us. Q4 was a strong finish to a volatile year. We ended fiscal '21 with total ARR of $2.36 billion, up 41% year over year; cloud ARR of $810 million, up 83% over last year; and 510 customers with ARR greater than $1 million, up 44%.

On our last call, I described the slowdown in the close rates for several of our largest orders in the final weeks of Q3, which we attributed to persistent uncertainty stemming from COVID and other macro factors. We said all indicators pointed to strong demand overall, but some customers were taking a pause to reevaluate the timing of high-value spending commitments. We were confident in the eventual closing of many delayed transactions, but specific timing was uncertain. Today, I'm pleased to report that not only did we close transactions with several of the accounts that had deals slip from Q3.

But we did not see a repeat of slower close rates in Q4 to the degree that we saw in Q3. Now on to results. We ended the period with total RPO of nearly $2 billion, up 10% over Q4 of last year. And the portion of RPO, which we expect to recognize as revenue over the next 12 months, was just over $1.2 billion, up 23% from last year.

It's important to note that both current and total RPO growth rates were muted last year as we didn't yet have the benefit of renewal bookings from a substantial pool of previously booked multiyear contracts. As we highlighted at Analyst Day, we expect that the renewal of a sizable base of perp-to-term conversions that we initially booked two to three years ago will begin to contribute meaningfully to overall bookings this year, FY '22. These renewals should drive bookings growth and the convergence of RPO growth and ARR growth rates over the next 12 to 18 months. On the P&L, total revenues were $745 million in Q4 and $2.23 billion for the full year, both down slightly from last year, reflecting substantially higher cloud mix as well as a sharp decline in average duration for term contracts.

We expect that average contract duration will start to normalize in Q1 as we lap the first anniversary of the pandemic. Q4 cloud revenue was $171 million, up 72% over last year, and full year was $554 million, up 77%, both reflecting continued acceleration of customer adoption of our cloud platform. On margins, which are all non-GAAP, cloud gross margin was 62% in Q4 compared to 54% last year, with continued progress toward our long-term target of at least 75%. Total gross margin in Q4 was 83%, down on a year-over-year basis due to the greater proportion of revenue contribution coming from cloud.

Operating margin was 13% in Q4, substantially higher than planned due to our significant top line outperformance, and full-year op margin was negative 4%. Again, operating margin is impacted by lower revenue from shorter average term contract duration and growing cloud mix. Finally, operating cash flow was negative $191 million for the year, about $100 million better than last year and in line with our expectations following our shift to annual invoicing in fiscal '20. Turning to guidance.

While the demand environment is strong, given the continuing market uncertainty, we remain cautious on specific growth expectations until there are clear signs of market recovery and stabilization. Until then, we will be keeping our guidance horizon short. As such, we expect to end Q1 with total ARR of between $2.42 billion and $2.44 billion. On the income statement, the cloud transition continues to drive variability in our revenue and operating margin results.

We expect total revenues of between $480 million and $500 million depending on cloud mix, with a non-GAAP operating margin of approximately minus 30%, reflecting our normal seasonal pattern. In closing, Q4 was a strong finish to a very unusual year. We outperformed our targets in the first half during the onset of the pandemic, saw lower-than-usual large deal close rates in the final weeks of Q3 and then closed the year with strong execution in Q4. When we look back on the year as a whole, we're very pleased with the progress of our transition and the strength of our cloud business, in particular.

It's become clear that the headwinds we're facing are predominantly from the term business as customers have been cautious to make long-term commitments, especially during the pandemic. On-prem customers are also being more measured in the size and length of their term contracts as they contemplate their plans for substantial cloud expansion with Splunk. While the term business will likely remain volatile, we expect our cloud business will continue to ramp quickly. The overall demand environment remains strong, and cloud continues to outperform our expectations, as you can see in the very high ARR and revenue growth rates.

We're planning for continued cloud strength in our business and look forward to keeping you updated on our progress on future calls. With that, let's open it up for questions.

Questions & Answers:

Operator

[Operator instructions] Our first question comes from the line of Kash Rangan from Goldman Sachs.

Kash Rangan -- Goldman Sachs -- Analyst

Thank you very much. Congratulations to the Splunk team on putting up a really good show in this Q4. One question for Jason and one for Doug. One for Jason.

As you look at the cloud numbers, I mean, certainly, you're seeing cloud ARR accelerate at scale, which is truly significant. As you play this out, there is a transition that the company went from license to subscription, then going from subscription to cloud. As you play this out, is it not conceivable that in a 2-year time horizon or so, if cloud becomes a majority of the revenue, you do actually become a cloud company? And what are the implications of that for the Splunk business model? And one for you, Doug, if you can, given that there's a lot of crosscurrents, you've had a change in leadership with the departure of a worldwide head of field operations and also increasing noise about the competitive environment. And it looks like the execution has certainly improved.

What is your -- as you sit today and do this call with us, what is your outlook for Splunk given the perception of greater competition, the hires you might or might not be making to the executive team and how your business pans out and your confidence overall? Although you don't have a target for us three years out, how do you think about the three-year outlook for Splunk, given all the crosscurrents that are being discussed? Thank you so much once again and congratulations.

Doug Merritt -- President and Chief Executive Officer

Thank you very much, Kash. I'll start and then let Jason follow-up with the cloud piece, which I think is very prescient of you, Kash. I agree. So from a Splunk competitive position, I am really excited about where we are right at this point in time.

Now I feel like we're in a better position than we've ever been. The continued expansion of our data-to-everything capabilities; feathering and stream processing and having that become a much more material portion of the data-to-everything platform; continued enhancements in machine learning, streaming and non-based collaboration services; orchestration services, I think, sets us up to be in a good position as the industry continues to pivot. And just as importantly or more importantly, the continued enhancements of our solutions and suites that focus on security, ITOps and observability, I think, are very, very well positioned with strong technical buyers. And a lot of repurposing and cross-fertilization between the data and the use cases across those three buyers.

The marketplace will continue to get more competitive, no doubt. I think that we were early in all areas. Security is probably the prime example of calling it a data problem, not a transaction problem, or -- and I think as people have woken up -- continue to wake up to the importance of data and the importance of the buyers that we're going after, we absolutely should all expect more people to participate. And we estimate that's $85 billion to $90 billion worth of total addressable market just across our key target areas.

We were very proud of our $2.365 billion in ARR as a company and $810 million of ARR as a cloud provider. But as -- we can always do the simple math, that's a small percentage of that TAM, so a lot of people chasing as they should be. And I will continue, and my team will continue to look for any and every awesome talent that we can bring into the company. While we're excited about the progress we've made over the past five years, we are shooting for the $5 billion, $10 billion, $20 billion mark.

There's a big TAM and a lot we have to do. So whether it's the development and sales and marketing teams continue to bring in really, really best-in-class folks, I'm so impressed at the people that we're adding to the team, or any continued shifts that we'll be making to augment and strengthen our executive ranks, that's what we have to do to be able to be as competitive as we need to be to capture the majority or lion's share of these very key and crucial markets. Jason, do you want to chime in on the cloud business and its impact overall?

Jason Child -- Chief Financial Officer

Yes. So on the cloud business, yes. So as you pointed out, we've seen really strong ARR growth throughout the year. And so clearly, over time, we will get to a point where I think you saw last year for the first time on a software bookings basis, 50% is cloud.

We've said in the past, we expect that number to continue to grow. We forecast that it could be 70% to 80% over sometime in the next few years. And so you should expect to see that the revenue related to the cloud business should be over half of the revenue, probably not likely this year, most likely next year. That said, I mean, you can kind of model.

You can see how the cloud business has been pretty steady in the 70% to 80% range now for going back, I think, the last quarters. If you look at the term business, that's kind of where -- if you kind of step back, that's where some of the volatility has been. And I think this last quarter, you can do the math and basically see that the term business grew at about 26% -- the ARR grew 26% year-on-year. That's moving around a little bit, partly due to customers trying to assess either impacts from the pandemic as well as trying to figure out how much capacity they want to buy before they make their transition to cloud.

And so even though that number is volatile, it's really not kind of an indication on the health of the business. It's more about an indication of what customers want to preserve flexibility so they can continue to make their own plans to move toward cloud, which is what the vast majority of customers have indicated.

Operator

Our next question comes from the line of Brad Zelnick from Credit Suisse. Your line is now open.

Brad Zelnick -- Credit Suisse -- Analyst

Excellent. Thank you so much. I'll echo Kash's congrats. Great quarter.

And it's nice to see a return to the kind of performance we expect from Splunk in Q4 especially in cloud. So I don't want to dwell too much on the past, guys. But just as we think about Q4 and the selling environment and what you're seeing out there, I'd just be curious to get a sense from you, guys, how you would characterize the appetite for large deals and how things are unfolding. It's obviously happening very quickly.

And then specific follow-up to what Kash had asked. I have picked some recent changes in the North America sales leadership beyond Susan's departure. Just wanted to check in on how you're thinking about the stability and productivity of the field organization, specifically in North America?

Doug Merritt -- President and Chief Executive Officer

Thank you, Brad. It's Doug. I'll start off. So the macro environment that I think I've consistently talked about all quarters, even after, I think, a very impressive Q1, appears to be pretty consistent, which is with so much volatility in the -- both with the pandemic and the stock market and the potential impacts on the economy, the No.

1 thing that we have seen is a lot more scrutiny on high dollar-value transactions. And in all of my CEO circles and one-on-ones with other CEOs, whether they're specifically talking about it on earnings calls and other venues or not, it's something that we are all seeing. We saw the same thing in Q4. I think what we have been focused on over the course of this year is staying very focused on the environmental factors that we can control, not the macro factors that we can't.

And I talked a bit about what we're doing to be prepared for potentially similar behavior in Q4 to help mitigate the risks in Q4 and have us come in within our range or, in this case, over our range for the quarter. We'll see what happens to Q1 and Q2. If we can keep getting back -- progress on vaccines and opening up the states and the stimulus passes, and then hopefully, we'll see some of that scrutiny come down. But I'm proud of the teams and excited about the work we've been doing because I think it really has helped us up our operational game pretty dramatically across the different theaters and the way that we triply lock down on validating budget and trying to flush out unforeseen blockers outside the economic buyer, even when budgets are fully approved and the economic buyer thinks they've got free rein.

In North America, we were very excited to promote one of our superstars to lead North America, the Americas, I should say. And eager to see how he continues to grow into that role. As you guys all can imagine, when you're growing the business overall and ARR rates are in excess of 40%, cloud growth rates in the high 70% to 80%, a number that was the number three years ago becomes a very different number going into this year and next year. So it's our job to continuously groom and make sure that people have got the right skills to be able to scale and continue to bring in additional talent to work side-by-side or over or around different folks, so that we can keep fulfilling the opportunity of TAM that's in front of us.

And there's always change, always change, and we're just trying to stay in -- as in front of us as we possibly can. I think we've got a very compelling opportunity for our reps this year. I think we continue to try and do a better job as we move to ACV and incremental ACV to make the numbers clear and continue to build confidence that they're achievable and over achievable. And my expectations for our sales force this year is that those that put their head down and work are going to have really, really good years with the targets that we've rolled out and the portfolio that we have for them to sell.

Brad Zelnick -- Credit Suisse -- Analyst

Awesome. Thank you so much, and congrats again. Stay well, everybody.

Operator

Our next question comes from the line of Raimo Lenschow from Barclays. Your line is now open.

Raimo Lenschow -- Barclays -- Analyst

Thanks. Two questions if I may. First, let me stay on the cloud side. Doug, you obviously have been on a journey there.

And I remember about this time last year, you said like only like the minority of sales guys have actually started selling cloud. Like talk a little bit about the evolution there in terms of sales force adoption. You mentioned a little bit of some of the incentives you have in place there to give us a feeling of where we are on that journey, how much we have -- how far we have progressed so far? And then the second question I had was SolarWinds, obviously, kind of created a lot of noise and a lot of discussions around security. We picked up on our checks, there's a lot of focus on SIM.

You guys, obviously the leaders, how much did that help this quarter? And how much did that kind of reengage discussions around that subject? Thank you.

Doug Merritt -- President and Chief Executive Officer

Thank you, Raimo. So I -- cloud absolutely is a highlight. It has been the No. 1 highlight for the company.

It's been the No. 1 company priority for three years now, and we're maintaining it as our No. 1 key and top initiative this year as well. And again, in the published data, you can go back to FY '18 and see the very, very consistent and high-growth cadence on a revenue basis from $93 million in revenue in FY '18 and cloud at $554 million this year -- including this year.

Similar on the ARR basis, you go back to FY '18, $128 million in ARR in FY '18 at a 103% growth rate, closing out this year at $810 million with an 83% growth rate. So that performance is, I think, very admirable. If you go and look at the other pure-play cloud companies out there, Datadog, New Relic, Sumo, Salesforce, Workday, ServiceNow, CrowdStrike, you'll see our ARR and revenue performance to be well above, really, all those players right now, significantly above some of them. So we're excited about cloud.

We are seeing more and more reps transact cloud, and that would be part of the 51% of software bookings being attributed to cloud this year -- this past year and in Q4. We expect that to increase in FY '22. Only real gate right now for reps is are they serving a customer or a segment of the world where cloud is either not something that the customer or that portion of the world is excited about or where our offering is still not where it needs to be on a compliance or a regulatory basis, as we work hard to make sure that we are highly applicable in every major region of the world and able to meet the customers' needs.

Raimo Lenschow -- Barclays -- Analyst

Yes. OK. And then the SolarWinds?

Doug Merritt -- President and Chief Executive Officer

I'm sorry?

Jason Child -- Chief Financial Officer

SolarWinds.

Doug Merritt -- President and Chief Executive Officer

SolarWinds, yes. I think we've probably got a bit of a boost on SolarWinds. When you look -- and it's more about the hack and the need to really understand what happened in the landscape, and that's where a data platform like Splunk comes in. We have a different offering than SolarWinds.

So I don't think that we've got a huge opportunity to do full rip and replacement of SolarWinds. And I'm not even sure if that's a wise move for many organizations out there. But we do provide a whole different level of scrutiny and capability on monitoring, on detection, on alerting, on reaction or remediation and ingest a lot of the data that makes other products out there more effective and more capable. This year, you will see a lot of energy around security.

And we've obviously been very focused on security, and I think it's a really, really important use case. It's not abating anytime soon. We've got a bunch of releases that we're really excited about this year. That will continue to keep us, I think, in a pole position in the security landscape.

And as much as we've been jumping up and down with observability, which we're still incredibly excited about, and we can talk about another -- in the next Q&A or the next person's Q&A. I think security is going to continue to be a standout performer for us this year, too.

Raimo Lenschow -- Barclays -- Analyst

Perfect. Very clear.

Operator

Our next question comes from the line of Phil Winslow from Wells Fargo. Your line is now open.

Phil Winslow -- Wells Fargo Securities -- Analyst

Hey, guys. Thanks for taking my question, and congrats on the stronger than expected close to the quarter. I really wanted to focus in on the pricing commentary that you made. Doug, I think you highlighted your workload-based pricing is impacting the quarter.

I guess, a couple of sort of sub-questions to this. First, how is sort of customer awareness of the newer pricing models, workload, predictive pricing? Second, how is this changing customer conversations now? And then also from a sales force perspective, sort of how sort of ready to ramp is the sales force in communicating these pricing models and comparing them?

Doug Merritt -- President and Chief Executive Officer

Great question, Phil, and great to hear from you. This -- the awareness on pricing is definitely -- continues to be one of the top areas of our focus through this year. As we all know, pricing changes are hard. I think one of the notes out said, a lot of transformations for Splunk, including pricing.

This is a really important one. A couple of metrics that we saw this year that excited me that shows that we're getting the traction that we're hoping. A third of the overall FY '21 cloud ACV was workload pricing based. And almost half of the Americas cloud ACV, which obviously is our more deeply penetrated, most deeply penetrated theory, was workload-based pricing.

So it is getting traction. Do we need to do an even better job of marketing it and driving awareness? Yes. Do we need to educate? I think the reps are actually pretty darn educated at this point in time. There's a strong additional education track at our SKO.

But do we need to keep doubling down on that so they understand it, fully understand it? Yes. Do we need to get even more aggressive with the partners so they understand it? Yes. But I'm hopeful that over the course of this year, especially because it is the default motion within cloud that we will see that third of cloud, the workload pricing, go up by a pretty dramatic basis and the impact on almost half of America is you see cloud ACV -- see that spread to EMEA and APAC as well.

Phil Winslow -- Wells Fargo Securities -- Analyst

Got it. And then just one more sales force follow-up. If you think about observability, which is obviously something you highlighted in Q4 as an area of strength, how ready do you think the sales force is to make not only, call it, the ITOps pitch and the security pitch, but actually the broader security pitch -- sorry, the broader observability pitch as well?

Doug Merritt -- President and Chief Executive Officer

Really, really good question, Phil. Great growth year for observability, by the way. Triple-digit growth in observability and really proud of the team there. Also really excited about the continued integrations, enhancements, ease of use and the inorganic work that we're doing within observability.

For all of you on the call, I did mention the GigaOM report that just came out. We are the only outperformer in the entire report, and we're the most functionally complete offering across all the observability vendors. So I think we've got a really good hand there, making sure that every account understands we have there on a marketing basis. And then we've got the right sales support is key this year.

I think the go-to-market piece is a key linchpin. I feel good about the product offerings. We are not just maintaining our observability sales force, but we're beefing up our observability sales force. And we're actually mirroring or complementing the observability dedicated sellers with security and ITOps dedicated sellers as well.

That was a successful enough model with us last year that when Christian was tailoring the landscape this year, the highest hiring orientation is to complement the generalist account managers with a growing body of hunter, Type A, classic sales specialist -- sales reps, not so much specialists overlay but dedicated sales reps in security, ITOps and observability. So we expect and are counting on observability having as good or better of a year this year as it did last year.

Phil Winslow -- Wells Fargo Securities -- Analyst

Congrats again, guys.

Doug Merritt -- President and Chief Executive Officer

Thanks, Phil.

Operator

Our next question comes from the line of Matt Hedberg from RBC Capital Markets. Your line is now open.

Matt Hedberg -- RBC Capital Markets -- Analyst

Hey. Great, guys. Thanks for taking my questions. I'll offer my congrats as well.

Doug, you've always been strong at expansion. And I think with the expanded portfolio, it's a really intriguing option for you guys to continue to drive more wallet share. I didn't notice the customer count. I know you said you had strong close rates.

I'm just sort of curious if you could talk about that motion of new customers now that cloud is 51% of bookings, a majority, do you get a sense that maybe that land piece of the equation could start to accelerate in fiscal '22?

Doug Merritt -- President and Chief Executive Officer

Great. Great question. And yes, I've said for a couple of years now that we've been consistent with our new customer count. It's staying 2,000-ish new customers per year, which is great, but not expanding at an expanding rate like we'd like to see.

Two interesting trends this year. One, one-third of the cloud customers are net new. So we're seeing that happening the way we had thought, which is if it's easier to find, try and buy, which I think cloud is really the driver for, that should expand the net new rate for us. And then two, Q4 was the first big uptick in net new logos in, I don't know, probably seven or eight quarters.

So we have two trends that at least are early indicators that as we continue to focus on cloud breadth and depth, and I think most importantly, in FY '22, ease of use on all aspects, including online purchasing, that we'll see that number finally start to get the uptick that we've been targeting and talking about for too many years now.

Matt Hedberg -- RBC Capital Markets -- Analyst

Yes. That's really good to hear. I mean, I think that's what kind of we all would suspect. So it's good to hear those nuggets were good.

And I guess maybe as a follow-up to that, it looks like you guys are hiring at a rapid pace. And with new sales leadership, how do you approach this? Obviously, you're not giving us full-year guidance, but when you think about new reps vis-à-vis your kind of Q1 ARR growth, how are you thinking about that balance between new reps and productivity gains? Because it seems like there's a real opportunity to kind of accelerate some of this new business momentum that you discussed and talking about.

Doug Merritt -- President and Chief Executive Officer

Yes, I agree. And yes, for -- you can see a ton of openings in our website, and it is crazy. I'm sure we're not alone with other high-growth companies to really think through how many people have been hired over the past 12 months that have never been inside of a Splunk office and physically met other Splunkers. So cannot wait for that to start to happen and get the benefits of the physical culture that we're so famous for.

We are keeping the foot on the gas for hiring across the board this year, including in the field. I think a very positive element for our field reps is a big chunk of the hiring is complementary to the generalist account manager. We continue to ramp our renewal sales team, which is a benefit to the existing account manager. And as I talked about earlier with Phil, we are focusing on complementing the generalist with IT, security and observability sales specialists.

So we're targeting, I think, a reasonable productivity number with that for reps. But that productivity is coming because they're getting more resources and more tools to help them within accounts. And then if you add in the net new attraction with cloud, especially as workload pricing for the platform and device pricing for the solutions, which I think simplify that dramatically, continue to kick in this year. We -- as I said earlier, I think it should be a really stellar year for our sales teams, building even stronger for the sales reps in FY '23.

Matt Hedberg -- RBC Capital Markets -- Analyst

Thanks a lot.

Operator

Our next question comes from the line of Brent Thill from Jefferies. Your line is now open.

Brent Thill -- Jefferies -- Analyst

Thanks. Doug, just going back to the deals that slipped in Q3 into Q4. We've got numerous questions about -- are most of those now cleaned up? Did you get the majority of the larger ones through the finish line? Or are there still a few lingering transactions? And I have a quick follow-up.

Doug Merritt -- President and Chief Executive Officer

Yes. As we said in prepared remarks, we were happy to see the transactions that came through with the accounts that had the extra scrutiny that we talked about in Q3. And again, just a reminder, that top 10 customer realm we talked about was just emblematic. It was just a data point.

There's some increased scrutiny out there, and let me just give one data point that we're working with. We had some really nice traction through Q4 as well with being -- trying to stay a step ahead or aware of or work with the known macro reality that big-ticket deals are going to have additional scrutiny. So really, really impressed and proud with the resiliency and thoroughness of our sales teams to do everything they can to kind of flush out that unforeseen stoppage that we were experiencing throughout the year. And again, as I said earlier, I feel like it -- what doesn't kill you makes you stronger.

I think that the teams really came through this year with a nice bonding and a whole degree of appreciation and rigor that I am hopeful will carry through FY '22 as I'm sure we'll be dealing with all kinds of new surprises this year and hopefully, most of them positive, but still new changes in the environment.

Brent Thill -- Jefferies -- Analyst

OK. And just back to your comment, Doug, a compelling opportunity for your sales reps this year. As you go into the new year, what overall changes have you made on the go-to-market? Anything that you would highlight that is going to be a major catalyst and you think helpful this year that you would call out?

Doug Merritt -- President and Chief Executive Officer

I think that -- so when I look at the top three company initiatives over the past couple of years, they've been very consistent. Get to cloud and cloud-first is one. Continue to double down and penetrate the three core buying centers, security, ITOps and DevOps/observability is number two. And then continue to expand the underlying data-to-everything platform to serve those use cases, number three.

And I think all three of those really work in concert to help our reps. And the one that we're really, really focused on this year, and they're all three equally important, those were in priority order, was a continued focus on the three core buying centers. So from a go-to-market assistance, from a marketing campaign orientation, from ROI, tooling, feedback on usage patterns, we're getting -- continue to get more effective and refined in understanding the traction within those three core buying centers. And we're continuing, as you've seen, to add more features and function and capability to the underlying platform, for sure, but to the overall security offering, to ITOps offerings and observability offerings.

So lots of good expansion within their buying center, with the additional buying center-based reps, I think more effective cross-buying center selling. And then as we really do an effective job of cornering those three key user communities, that's when we start to see the company standardize on Splunk as a data platform. And those fund use cases that we talked about with Porsche and Domino's and BMW and Tesco and when they start to use this beyond, the technical buying centers kick in as they're focused on revenue generation and cost savings activities.

Brent Thill -- Jefferies -- Analyst

Thanks for that.

Doug Merritt -- President and Chief Executive Officer

Thanks, Brent.

Operator

Our next question comes from the line of Keith Weiss from Morgan Stanley. Your line is now open.

Sanjit Singh -- Morgan Stanley -- Analyst

Sanjit Singh in for Keith. And congrats on the really great Q4. Doug, I'm loving all these data points and nuggets that you're dropping through this Q&A. I could use more of that.

For my two questions, though, I want to start with Jason. On the acceleration in net new cloud growth in terms of that getting back to 80% -- plus growth. By your comments, it didn't sound like migrations was the key factor here. It sounds like net new customers and existing customers expanding.

If and when that migration motion starts to happen, should we expect an uplift on that term base over time? What's sort of the right way to frame what is already a great organic cloud growth story?

Jason Child -- Chief Financial Officer

This is Jason. So I would say -- I would think of it as being still early days. While it's 50% -- 51% of software bookings in the quarter, if you look at the ARR, it's more -- it's closer to one-third. And so I think you should expect that there is over -- well, there's a -- majority of our customer base still has not gone through that transition.

And so I would expect there to be pretty significant kind of tailwinds. In terms of whether the growth accelerates or whatnot, that, of course, is dependent upon the timing and a bunch of factors. But with the trends that we've provided on the website slides, you can see it's been pretty consistent and pretty strong for a while. I think the other thing I would call out is the dollar-based net retention, which is the cloud-based number, that still remains at our size, very, very high, 129% on a trailing four-quarter basis, which includes the slowdown that we saw in Q3 is still very, very kind of like best-in-class terms for an $810 million ARR business.

So I would expect that there are multiple points of kind of tailwinds across customers, across expansion history and future opportunities. And then also, Doug had mentioned observability, which is all cloud. That's still early days, but he mentioned the triple-digit growth numbers there. Three acquisitions last quarter that are also helping that, the observability suite in particular.

So there's just numerous tailwinds.

Sanjit Singh -- Morgan Stanley -- Analyst

Got it. And I appreciate the thoughts there. And then my question for you, Doug, is as enterprise starts your journey in sort of moving to a cloud operating model and frankly, building a new security fabric to enable that cloud operating model, we're starting to see some security vendors, whether it's CrowdStrike or Zscaler or Palo Alto, start to get into the monitoring game and a long-standing trend is monitoring guys getting into the security space. As we look at sort of the opportunity within cloud, building a cloud security fabric, who's going to have the strategic high ground? Whether it's the endpoint providers, the networking guys, coming from the policy layer or coming from the data layer like Splunk is? What's the -- in the eyes of customers, how are they thinking about building out these new security capabilities?

Doug Merritt -- President and Chief Executive Officer

It's a good question. Our view of the space has been consistent for my entire time here, so I guess seven-plus years now, that security is a data problem. The many, many different tools and proprietary elements that are thrown into that landscape to attempt to be a patchwork to prevent and remediate the huge variety of challenges and changes that customers have to deal with doesn't seem to have ever slowed down, doesn't seem to be slowing down now. And the only way that you can really make sense of that patch work is to have an effective, malleable, high-capacity non-structured data layer to be able to take in the constantly shifting data feeds and provide the full suite on monitoring, alerting, detection, remediation, investigation that we've been building our data-to-everything platform around and the security solutions around as well.

So I think that firms like Splunk are in a unique position. We're very open across the entire landscape. As you can see through Splunkbase and everything that exists in the market, we interoperate with and play with everybody because we don't have a dog in the hunt on the endpoint game in the network game. We -- there's too much variety within these different organizations.

The strength that I think that organizations are continuing to wake up to is the data that you are going to touch and wrangle for your security needs is the identical data sources, in most cases, that you also need to touch and wrangle for your infrastructure management, ITOps needs and increasingly, for your application development and DevOps needs. And that's where I think the real power of all the investments we've made across the data platform and the solutions on top become even more of a true return on investment outstanding player. And that -- we've stuck with that strategy for many, many years. We continue to stick with that strategy.

And we think it's the right strategy to help our customers in a very heterogeneous landscape that not only is multi-cloud but multi on-prem and cloud versions.

Sanjit Singh -- Morgan Stanley -- Analyst

Thank you.

Doug Merritt -- President and Chief Executive Officer

Thank you.

Operator

Our next question comes from the line of Keith Bachman from Bank of Montreal. Your line is now open.

Keith Bachman -- BMO Capital Markets -- Analyst

Thanks very much, and congratulations on the quarter. Doug, I wanted to start with you, and you used the word scrutiny, which is something that we've had conversations about with investors recently. And I want to break that down into something specific surrounding win rates. And the three buckets are security, ITOps and then observability.

Could you talk about as budget dollars get scrutinized, whether that's changed win rates at all? And if you could go through those three buckets, if you will, and characterize it? And then I have a follow-up.

Doug Merritt -- President and Chief Executive Officer

And yes, the buckets are important because the dynamics are very different between the three buckets. Then I'd add the fourth bucket, which is kind of general data platform layer as well. There are always shifts within those. But the overall win rates that we see in aggregate across all four buckets have remained super consistent.

We've been in the mid-80s to upper 80s on a win rate basis overall across the entire landscape. The puts and takes vary based on shifts that are happening in the quarter where we are the new entrant, which is something that we're not used to. We kind of came in and led the security arena. We led the ITOps arena.

I think we led the unstructured high-volume data platform arena, that is the observability area. So there's a lot of intensity and scrutiny that I am giving and the sales teams are giving and the marketing teams are giving, the competitive teams are giving to make sure that the recognition that we're starting to gain as the most functionally rich and capable solution, that translates into understanding by the customers, that translates into at-bats and RFP inclusion, and that, that translates into increasing win rates in that arena. So when I really look across the board, my -- I think our No. 1 focus is we really believe that's a strong emerging category, still pretty small, a lot of players, but growing fast as we can see with us and our competitors and one that we really want to ensure that we're successful in.

The other three, I think, is more about continuing to try and stay a step ahead of the competitors. We've got really strong position in those 3, whether this gets Elastic or Sumo or certainly, QRadar, last generation SIMs, the cloud service providers, as they continue to try and strengthen their security offerings. And so going back from my earlier comments, the tailwinds that we're getting or the combinatorial impacts that we're getting in ITOps as we're leveraging some of the DevOps and the observability capability, I think, is helping us, and that should be a big impact this year. And we're really, really focused on making sure that the deliveries we have slated in the security arena hit with the quality and ease of use that we're looking for, and we keep our lead in the security space.

Keith Bachman -- BMO Capital Markets -- Analyst

OK. Yes. It seems like your leading security space is good. The one I was really wondering about was ITOps.

But let me move over to Jason in the net retention rate or cloud net retention rate. Anything you want to call out, Jason, on puts and takes as we think about that, how that number rolls out through the year? It's good news to hear that new logos may increase during the year, certainly did in Q4. So hopefully, that keeps up. But Jason, anything you want to tell us or call out on the net retention rate?

Jason Child -- Chief Financial Officer

Well, I mean not really. I mean, it's been consistent. And obviously, as the numbers get much larger, once you get to approximately getting close to $1 billion in ARR, to hold a high 20s, 120-plus percent net retention is -- it's pretty rare. So overall, we're very happy with the numbers that we see.

And at this point, every quarter, there's probably a little bit of nuance between -- is the growth coming more from logos or coming from expansion within existing accounts. Overall, pretty much everything is up into the right, right now with cloud. And we'll let you know if something changes. But I think the progress is pretty clear and something we're very proud of.

Keith Bachman -- BMO Capital Markets -- Analyst

OK. Thanks very much. Cheers.

Doug Merritt -- President and Chief Executive Officer

Thank you.

Operator

Our next question comes from the line of Michael Turits from KeyBanc. Your line is now open.

Michael Turits -- KeyBanc Capital Markets -- Analyst

A couple of questions for Jason. First of all, on RPO, which do you sell on total this quarter, and you did mention, obviously, there's been some duration headwinds. I just want to make sure I get the mechanics right, Jason, that there's a -- from my understanding is there's more that will be up for renewal, essentially in next year, and we'll start to get, therefore, an acceleration in both total and current RPO?

Jason Child -- Chief Financial Officer

You got it. That's right. And basically, the -- in the older days, if you got to break out, RPO is really two primary components. So when you sell term, it's either going to be if you're having long-term ramping deals where you have capacity growing over time.

The only thing that sits in RPO is the piece that ramps. And so as duration comes down, we have a lot less of that right now. So you're kind of lapping a period where you had more gains to RPO in the past because of ramping deals. The other aspect of term would be, of course, the maintenance.

And so if you have longer durations, you're going to have more RPO coming from the longer maintenance contracts. Then that's offset by the cloud aspect since almost all of cloud sits in RPO and then, of course, is recognized ratably into revenue every quarter. So as -- and so while cloud is growing quickly, we're coming off of some pretty huge term RPO gains that were put in place really over the past couple of years when we made the perp-to-term conversion motion. Now as those -- a lot of those big initial term deals are coming up for renewal this year, you're going to see the renewal base grow significantly.

And as we sign those renewals, you'll see RPO start to replenish and grow pretty significantly, especially in the back half of this year.

Michael Turits -- KeyBanc Capital Markets -- Analyst

And that should impact total and current as well, correct?

Jason Child -- Chief Financial Officer

It will impact both. The duration impact, of course, is more on -- is going to be more on total RPO. Current is going to be more impacted by cloud.

Michael Turits -- KeyBanc Capital Markets -- Analyst

Right. And then, Doug, I hope you don't mind if I ask Jason another question here. Sure, I'll bug you about stuff. And so...

Doug Merritt -- President and Chief Executive Officer

Not at all.

Michael Turits -- KeyBanc Capital Markets -- Analyst

But obviously, I understand it's a volatile time, so we didn't get the fiscal '22 or the long-term guide. But given what seems, at least factoring out duration, that you should have a little bit more visibility into -- in the ACV, are we at the point where we can get some feel for cash flow from ops this year? Or you're minus $200 million this year, does that flip in a meaningful way this year? I would think you'd have a little more of a view there.

Jason Child -- Chief Financial Officer

Well, the biggest driver to cash flow, first, is that we are now lapping the impact of changing the invoice -- invoicing methodology two years ago. That happens in -- starting in the Q3. So that's the biggest reason why now we're no longer -- a couple of years ago, we went from a period of collecting most of our revenue upfront to now collecting or invoicing annually. And since we're at about a 2.5-year average, that means we had kind of a hole in the last two years.

So we started lapping that in Q3. So that's the biggest impact. Let's say, second, then ARR growth is what's going to be the new and expansion of -- within accounts and new customers is what's going to lead to incremental ARR. That's going to lead to more inflow.

The offset, though, is we're not guiding beyond Q1. And therefore, I can only speak to the ARR piece at this point. What I can say is you will definitely see cash flow revert to positive this year. And then I'd say, we'll update you to the magnitude of the cash flow as we kind of go throughout the year quarterly.

Michael Turits -- KeyBanc Capital Markets -- Analyst

Thanks, Jason. And thanks, Doug, for not being offended on the focus on financials.

Doug Merritt -- President and Chief Executive Officer

Never, Michael.

Operator

Our final question comes from the line of Kirk Materne from Evercore ISI. Your line is now open.

Kirk Materne -- Evercore ISI--Analyst

Yeah. Great. Thanks for sneaking me in. Doug, maybe just to start with you.

It seemed like the international business had a pretty nice quarter. Obviously, a good quarter for term licenses. So maybe, I imagine it's a little bit heavier on the international front on that side. But can you just talk about that bump? And it seemed like it outperformed a little bit this quarter and just what you're seeing in that theater? And maybe if any of the trends around cloud are a little bit different internationally than in the U.S.

right now?

Doug Merritt -- President and Chief Executive Officer

Yes. Very good call out. Yes, I'm really, really proud of the international teams. In particular, EMEA had a fantastic quarter in Q4.

It's been -- but what I'm really excited about is it's been a steady build all year long. The leadership team that we have over there, I think, has just done a fantastic job of emphasizing the right things, the right relationships with the reps, transitioning through a really difficult year of a lot of chaos, of stay at home -- no, don't stay at home, that EMEA has had to deal with. And I think it's laid the foundation for what I believe will be consistent performance over the coming years. Same thing in select markets in APAC, who also -- they were early on with the pandemic and have had a bunch of variety of challenges they've had to deal with.

Cloud does tend to be a little bit behind. It depends on the market. Australia is a lot more like the U.S. Central Europe is a little bit behind as far as cloud.

But my other highlight that I saw internationally this year, especially again, in EMEA, was a really, really strong shift and expansion from where they were on the cloud business as well. I think the pandemic certainly creates some headwinds on things like deal scrutiny or big deal scrutiny. But it certainly has emphasized the need for every organization to pivot to cloud and invest much more strongly with cloud. I'd say that, that had an impact on our cloud ARR and revenue, but it's actually been -- our growth there has actually been pretty consistent.

But it's certainly, I think, it's probably helping it to stay at such a consistent rate. And I think it's a big opportunity internationally as those countries and those verticals become more comfortable with cloud to see the expansion we've been watching in the U.S. happen in the same way internationally.

Kirk Materne -- Evercore ISI--Analyst

OK. And maybe just last one, just because you brought it up. On the big deal scrutiny point, Doug, I was just kind of curious because if you look across the board right now, tech, IT spending budgets are pretty -- doing well, meaning I think they're opening up pretty well. So when you're thinking about big deal scrutiny, is that just simply a case of sort of the amount of debt they want to make from a term perspective or a capacity perspective, meaning they're going through a sort of a technology infrastructure shift and that's sort of holding them back? Or are you still seeing companies that are sort of holding back on budget because of the macro? Because I think you're hearing more companies say, hey, things are opening up.

And I realize you have sort of a different game you have to play in terms of helping them through these -- the shift from on-prem to cloud. So could you just clarify that maybe a little bit?

Doug Merritt -- President and Chief Executive Officer

Yes. I think it's a little bit of both. I think that the -- while there is momentum right now, especially for cloud spend, it depends on the industry, how confident people feel in their overall revenues and, therefore, their ability to increase their spend on IT. I think IT is increasing as a percentage of revenue in most industries.

But when you look at many of the industries that we serve that have been under a lot of pressure, the oil and gas industry, which we're strong in, the retail industry, the travel and hospitality industry, there's a lot of pressure on spend there given the unfair impact that they've had. And that's balanced by expanding portfolios in the high-tech industry. We look at Zoom or Shopify or Atlassian or other key customers that we've had, they're scrambling to keep up right now, which has been good for us. But it's -- we're a big enough size now and play across all industries and all major geos.

And then I do think your second point is important, which is, there's a different level of thoughtfulness and scrutiny on on-prem spend than there is cloud spend given that term is still -- the on-prem, which is really term, but on-prem is still a majority of our customer counts and bookings. That has, I think, even a more meaningful impact on any quarter forecasting for us than the pandemic itself. Because as Jason talked about term length and size of term deals, and that is more all over the map on a quarter-by-quarter basis, whereas cloud is pretty strong and consistent.

Kirk Materne -- Evercore ISI--Analyst

That's right. Thanks for that. Thanks for that, and congrats on the call.

Doug Merritt -- President and Chief Executive Officer

Thanks, Kirk.

Operator

At this time, I would like to turn the call back over to Doug Merritt for closing remarks.

Doug Merritt -- President and Chief Executive Officer

Thank you. Well, thank you all for spending time with us. I know there's other companies reporting today. I just want to conclude by going back to a comment I made during the Q&A, which is we've had three very consistent company priorities for the past three-plus years: get to cloud, continue to double down on our three core buying centers and continue to expand our data-to-everything platform.

I'm really proud of the progress we're making across all three. I'm really proud of our willingness to continue to innovate and disrupt ourselves so that we can serve our customers effectively and create the right long-term durable growth for all of you as investors. And I'm enthusiastic about what we see in front of us in FY '22 and FY '23. We've been making a lot of investment to make sure that all three initiatives continue to move forward.

And I feel like we're very well positioned over the next 24 and 36 months to continue to see benefit from those investments. Just want to call out a huge thanks again to the Splunk community, our employees, our partners, our customers for their support and focus and resiliency to this year. And we'll be talking to you all again in three months for our next earnings call. So thank you.

Operator

[Operator signoff]

Duration: 39 minutes

Call participants:

Ken Tinsley -- Vice President, Investor Relations and Treasurer

Doug Merritt -- President and Chief Executive Officer

Jason Child -- Chief Financial Officer

Kash Rangan -- Goldman Sachs -- Analyst

Brad Zelnick -- Credit Suisse -- Analyst

Raimo Lenschow -- Barclays -- Analyst

Phil Winslow -- Wells Fargo Securities -- Analyst

Matt Hedberg -- RBC Capital Markets -- Analyst

Brent Thill -- Jefferies -- Analyst

Sanjit Singh -- Morgan Stanley -- Analyst

Keith Bachman -- BMO Capital Markets -- Analyst

Michael Turits -- KeyBanc Capital Markets -- Analyst

Kirk Materne -- Evercore ISI--Analyst

More SPLK analysis

All earnings call transcripts