Splunk (SPLK) Q1 2023 Earnings Call Transcript

Splunk (SPLK)
Q1 2023 Earnings Call
May 25, 2022, 4:30 p.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Thank you for standing by, and welcome to Splunk's first quarter 2023 financial results conference call. [Operator instructions] As a reminder, today's program is being recorded. I would now like to introduce your host for today's program, Ken Tinsley, corporate treasurer and vice president of investor relations. Please go ahead, sir.

Ken Tinsley -- Corporate Treasurer and Vice President of Investor Relations

Thank you, operator, and good afternoon. With me on the call today are Gary Steele and Jason Child. After market closed today, we issued our earnings press release, which is posted on our investor relations website, along with supplemental material. This conference call is being broadcast live via webcast.

And following the call, an audio replay will be available on our website. On today's call, we will be making forward-looking statements, including financial guidance and expectations, including our forecast for our second quarter and full year fiscal 2023 and our expectations of revenues, renewals, operating margin, operating cash flow, and rule of 40 scale, as well as trends in our markets and business, our strategies, and our expectations regarding our business, products, technology, customers, demand, and markets. These statements are subject to risks and uncertainties and based on our assumptions as to the macroeconomic environment and reflect our best judgment based on factors currently known to us. Actual events or results may differ materially.

Please refer to documents we file with the SEC, including the 8-K filed with today's press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures, which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website. So with that, let me turn it over to Gary.

Gary Steele -- President and Chief Executive Officer

Good afternoon. I'm thrilled to join my first Splunk earnings call, reconnect with many of you, and talk with those of you I haven't met yet. It's been an amazing six weeks for me as I rapidly come up to speed on the business and the opportunities in front of us. I'd first like to thank Splunk Chair Graham Smith for leading the team during our CEO transition.

I recognize that such periods of uncertainty can create distractions, but this team stayed focused and drove solid execution in the quarter. I'm excited to report that we grew total revenues by 34% to $674 million, and cloud revenues by 66% to $323 million, reflecting strong customer demand and bookings momentum. Jason will dive deeper into the numbers in a few minutes. I'd like to start by sharing what inspired me to join Splunk, what I've learned so far, and my initial priorities.

Coming from a cyber background, I'd always admire Splunk for the role that it has played in providing the largest companies in the world unparalleled visibility that is essential to security teams to understand what's happening in their environment. Given this data-centric approach, I also fundamentally believe that there was so much more that could be done in that context given the complexity of an ever-growing attack surface and an unrelenting threat environment. Additionally, through my discussions with the Board, Splunkers, and customers, I began to understand the true power of the Splunk platform and the value it's bringing to organizations that are leveraging it for observability as well as many other use cases. What I came to learn is that Splunk is the technology underpinning and powering many of the largest companies in the world.

Splunk is a system of record that's deeply embedded within customers' businesses and provides the foundation for security and resilience so that they can innovate with speed and agility. All of this translated to a massive, untapped, unique opportunity, from which I believe we can drive long-term durable growth while progressively increasing operating margins and cash flow. Over the past couple of years, as Splunk transformed itself to a cloud company, it also positioned itself on a growth path with the critical ingredients to grow from over $3 billion in ARR to $5 billion and beyond. Underlying all of this is a loyal customer base that continues to expand their usage of Splunk.

For example, in Q1, our cloud dollar-based net retention was over 130%, a metric that is best-in-class among all SaaS companies. With the proliferation of digital and cloud transformation, security, IT, and DevOps teams are faced with an ever-evolving threat landscape, increased complexity from piling on more and more tools across hybrid and multi-cloud environments, and the silos created by all these data sources and fragmented teams that lead to inefficient detection and resolution. There is an enormous market opportunity to help customers navigate this new reality. Splunk provides insight into all data across the entire organization to ensure our customers' security, resilience, and agility to innovate.

For example, a global IT services provider and new Splunk customer selected us in the first quarter for a multimillion-dollar deal to oversee their NOC and SOC, with a focus on improving security and cyber resilience. This customer, like many of our largest, saw the value in having highly scalable, unified solutions for security and observability on a common platform. This three-year cloud deal replaced their legacy SIEM. As another example, a global apparel company extended their use of Splunk during the quarter with a multimillion-dollar order.

Where their tech ops organization has already been standardized on Splunk for cloud-based logging and observability, their security organization was using a different security platform that lack adequate scalability and insight into organizationwide data. The customer expanded Splunk across both tech ops and security in parallel. This decision enabled them to gain value from the same data but for different use cases, which reduce their total cost of ownership while broadening visibility across their system. My third story is a workload pricing deal.

We were selected as the best cloud-based solution for a growing financial services company serving millions of consumers. Delivering a scalable and efficient solution that provides greater visibility, we replaced their long-existing SIEM provider. This deal underscored our platform's ability to consolidate customers' existing tools to reduce outages and mitigate business risk to help protect end customers. The common thread that runs through these customer stories is their unique ability to get full fidelity, real-time visibility into their data, which traverses their on-prem and multi-cloud environments at virtually unlimited scale and velocity.

Our customers use Splunk to immediately realize actionable insights, irrespective of the use case, be it security, IT ops, DevOps, or countless other operational challenges. And let me be very clear on this point. We offer unique technical attributes that no other company provides. Our customers deeply trust Splunk with the security of their most critical business processes, which is why we've earned the right to support broader aspects of their organization.

And based on that trust, customers commit to Splunk for the long term. I look back at our 100 largest customers in each of the last 12 quarters, and on average, our retention rate with these customers is over 99%. Delivering such high value continues to earn us industry recognition. Already this year, Gartner has named us the top market share leader across security and IT operations and the only vendor to support all three approaches to AI ops, including data and analytics tools, AI ops features, and AI ops platforms.

We've also been recognized by Constellation, GigaOM, and Research in Action for leading the observability market. I've been overwhelmed by Splunkers' passion and high energy, and we have an exceptional base of talent serving our customers. I continue to meet with our teams around the world to understand our go-to-market and product opportunities. From these conversations, I see an opportunity for more streamlined processes across the company.

In line with this, my first priority has been to increase internal speed and agility across our people and organizations. Flattening our org structure will help us do that. You noticed that following the departure of Teresa Carlson, we did not backfill her role as president of go-to-market. Today, we're also announcing the departure of Shawn Bice, president of products and technology, and we will not backfill his position either.

I will be hands-on with the go-to-market and product leadership teams with an emphasis on scaling efficiently where we can. We appreciate your contributions here, Shawn, and wish you the best of luck in your next endeavor. Last week, we announced that Petra Jenner has joined the company as our general manager of EMEA. Petra brings over 25 years in leadership roles with Salesforce, Microsoft, and others, and she'll oversee go-to-market strategy in the region.

Welcome, Petra. We've also added our newly appointed Chief Customer Officer Katie Bianchi to our executive leadership team. As a tenured Splunker, Katie leads 1,200 people on our customer success and professional services teams tasked to help customers deploy Splunk and accelerate their time to value. The other top-line priorities for me are business execution and strategy.

We have to know what customers need in order to execute well. And so I've set the personal objective with the field to meet with 100 customers in my first 100 days of Splunk. It's an ambitious goal, I realize, but it's imperative for me to get deep and broad knowledge of how our customers view our engagement, along with the value and service levels we deliver. These inputs will be critical to product and go-to-market decisions.

I look forward to meeting with customers over the next several months as I travel worldwide and during our annual customer event, .conf, this June 13 through 16 at the MGM Grand in Las Vegas. Join us in person or virtually to hear our exciting product announcements and how customers like Stripe, Papa John's, REI, NewBank, Heineken, and many other industry leaders use Splunk to stay secure and resilient as they innovate with speed and agility. In closing, I'm eager to build upon the exceptionally strong foundation that many Splunk visionaries before me have built. As our recent momentum demonstrates, this is the best time to be here at Splunk.

We have an enormous opportunity to grow our business into a global enterprise software and services provider, and I'm excited to lead this team during our path to $10 billion in revenue and beyond. My sincerest thanks to each and every Splunker and all of our customers for your continued commitment. Now I'll turn the call over to Jason.

Jason Child -- Chief Financial Officer

Thanks, Gary. Q1 was a good start to the year with total revenues of $674 million, up 34% over last year, and cloud revenue of $323 million, up 66%. Total revenues were significantly higher than expected, reflecting more normalization in our model, plus higher-term contract volume, mostly from several very large renewals. Q1 cloud revenue was also up sharply over last year, reflecting continued customer adoption of our cloud platform.

Professional and services and education accounted for 7% of total revenues in the quarter. As I said last quarter, with revenue normalizing and average term contract duration more comparable on a year-over-year basis, RPO bookings is becoming a better indicator of overall bookings momentum. In Q1, RPO bookings was $491 million, up 32% over last year, reflecting strong customer demand. Our customer retention and expansion rates continue on their very impressive track, thanks to our strong product and services value proposition as well as our customer-centric support approach.

Our cloud DBNRR was 130% in Q1 and has been remarkably steady at this level since we first disclosed it several years ago. We ended the quarter with total ARR of $3.21 billion, up 30% year over year, and cloud ARR of $1.4 billion, up 60%. We had 690 customers with ARR greater than $1 million, up 28%, and 329 of these customers had a cloud ARR of over $1 million, up 62% over last year. On to margins, which are all non-GAAP.

Cloud gross margin was 68% in Q1, up 7 points from last year as we continue to realize leverage from scale and elasticity of the platform. Total gross margin was 75%, up 3 points year over year and reflecting a sharp improvement in cloud margin. Operating margin was negative 8.5% in the quarter, significantly better than planned due to our top-line outperformance and some modest expense optimization. For our EPS calculation, although it doesn't apply this quarter, it's important to note that we've adopted ASU 2020-06, which includes the share impact attributable to our convertible notes.

So for modeling purposes, if you estimate a GAAP or non-GAAP net income position in any future period, you should add 22.3 million shares to your fully diluted weighted average share count. Turning to guidance. For Q2, we expect total revenues of between $735 million and $755 million, with a non-GAAP operating margin of between negative 8% and negative 11%. Looking further out, due to our outperformance in Q1, plus the strength of our renewal base and solid execution, we are increasing our full year revenue expectation by $50 million to between $3.3 billion and $3.35 billion.

And we now expect a non-GAAP operating margin of about 2%, which is at the top of our previously guided range. We are maintaining our total ARR and cloud ARR full year targets, and we're reaffirming our operating cash flow expectation of at least $400 million for the year. So with revenue normalizing and cash flow now reflecting our change in customer billing terms from three years ago, traditional growth and profitability metrics are becoming more meaningful. This year, we're tracking to around 35% on a rule of 40 scale based on OCF, which is a nice step-up to the 25% last year and demonstrating the earnings power of our model.

In closing, execution in Q1 was solid, and we're set up for a great year. With the impacts from our business transformation mostly behind us, the growth of our business and leverage in our model are becoming clear. With that, let's open it up for questions.

Questions & Answers:

Operator

Certainly. [Operator instructions] Our first question comes from the line of Kash Rangan from Goldman Sachs. Your question, please.

Kash Rangan -- Goldman Sachs -- Analyst

Congratulations on the quarter, Gary. Nice to meet you. And I'm curious to get your perspective on when you look at Splunk as a business asset, I know you've certainly talked about your ambition to get the company to $5 billion, maybe even $10 billion of revenue. What are the things that excite you the most about Splunk? If you can just expand on that, that would be great.

And also, this is a very interesting time in the market. Everybody is worried about contraction in GDP, inflation, that sort of thing. What is your overall sense as to how the Splunk portfolio could hold up in the event of a more challenging cost center, labor markets, inflation, rates, etc.? Sorry for the long-winded question, but curious to get your perspective. Thanks a lot.

Gary Steele -- President and Chief Executive Officer

No problem, Kash. Nice to meet you. On the first part of the question, the things that really excite me here are: One, how deeply embedded Splunk is in some of the largest companies in the world, the way in which we underlie everything they're doing from a security perspective, and how they're running their IT operations is incredibly impressive. And it really plays out in our dollar-based net retention.

And so I think that we're just in a very unique position where we're delivering tremendous [indiscernible] and I think there's so much more that we can do in the market. I think I'd say that was the No. 1 thing that really got me excited when I got here roughly six weeks ago. Now going to your question about the macro environment.

One of the things that I'm personally encouraged by is that while there's lots of turbulence and a number of factors in the macro environment, the reality is that given the security environment that we're living in, with increasing concerns about what might happen relative to Ukraine, the continued concern about ransomware and other issues, Splunk sits right at the center of providing the visibility that security organizations need to understand what's happening. And so while there could be less than favorable market conditions, we're really mission critical in the value that we're delivering. And you extend that more broadly to the underpinning of all their critical apps, I think we're in a very good position to weather whatever storm might be ahead.

Kash Rangan -- Goldman Sachs -- Analyst

Wonderful. Congrats and look forward to the journey ahead.

Gary Steele -- President and Chief Executive Officer

Thank you so much.

Jason Child -- Chief Financial Officer

Thanks, Kash.

Operator

Thank you. Our next question comes from the line of Brent Thill from Jefferies. Your question, please.

Brent Thill -- Jefferies -- Analyst

Gary, welcome. Congrats on the role. During the quarter, the license component was very strong versus cloud. And I'm just curious if you could walk through perhaps what you saw on that.

And for Jason, maybe if you could just address the security versus nonsecurity components of the story. I would assume the security business continue to do very well like your peers have been doing. Can you talk about the nonsecurity aspects of the business? Are you seeing the same level of strength there? Any color would be helpful. Thank you.

Gary Steele -- President and Chief Executive Officer

Yeah, I'll start, and I'll let Jason jump in here. So from a mix perspective, we saw strength both in cloud and in on-prem. We're seeing many of our large customers work through the details of a migration to cloud. As we look across the whole year, we're very much encouraged by the level of momentum and interest we see there.

And I'll let Jason speak to some of the specifics as it relates to the exact number.

Jason Child -- Chief Financial Officer

Yeah. In terms of the security business, consistent with prior periods, it continues to be around 50% of the business. It is the fastest-growing part of the business, at least on a dollar basis. And I would say that the remainder of the business, which is really IT observability platform, those businesses continue to do well, but security is still the largest percentage of the business.

Brent Thill -- Jefferies -- Analyst

Thank you.

Gary Steele -- President and Chief Executive Officer

Thanks, Brent.

Operator

Thank you. Our next question comes from the line of Brad Zelnick from Deutsche Bank. Your question, please.

Brad Zelnick -- Deutsche Bank -- Analyst

Great. Thank you very much, and congrats as well on a strong print. And welcome, Gary. Gary, just related to how deeply embedded and strategic you see Splunk into its customers, I wanted to double-click a bit more on the leverage that you see in the model and the potential you see there because you talked about the efficiency and productivity of the investment Splunk makes.

And I think your reputation along these lines precedes itself. And we got the examples of maybe not backfilling some of the roles and departures. But anything else you can share would be really helpful. Thanks.

Gary Steele -- President and Chief Executive Officer

Yeah, a couple of things. So one is the role that we're playing for these mission-critical customers and the role that Splunk plays has -- it puts us in a really unique position where there's tremendous future opportunity. And as we think about the long-term model here, and I indicated this in the prepared remarks, I do believe that we have tremendous opportunity for long-term durable growth. But importantly, increasing cash flow and cash flow margins overall -- operating margins overall.

And I think there's efficiencies to be had in the organization. As I indicated, we're taking the first step by flattening the organization. I think that's one step forward in helping us operate more efficiently with more agility, with more speed in decision-making. And I think, over the long haul, that does translate into a lot of financial benefits for our shareholders.

Brad Zelnick -- Deutsche Bank -- Analyst

Excellent. Thanks so much.

Gary Steele -- President and Chief Executive Officer

Thanks, Brad.

Operator

Thank you. Our next question comes from the line of Raimo Lenschow from Barclays. Your question, please.

Raimo Lenschow -- Barclays -- Analyst

Thank you. And Gary, good to talk again. My question was, if I listen to you today, it's obviously as a new CEO is like your first conference call around Splunk. There seem to be a little bit more focus on security.

Can you maybe talk a little bit about how penetrated you see Splunk, like you bring a kind of security lens to it? And also, like how much of that is kind of due to the fact that in these more volatile times, we have obviously the situation that security spending will probably still be prioritized over other areas. Just a little bit of your take on that one. Thank you.

Gary Steele -- President and Chief Executive Officer

Yeah. It's a really good question. Nice to talk to you again. I believe, coming from a cyber background, that Splunk has always had a very unique position, but I also believe there's more that we can do to create a tighter partnership with customers and ultimately derive more value from the security buyers.

And so I'm personally very optimistic given the role that we play today and how we're positioned in those customers. And to your point, I fundamentally also believe that security will be much more resilient than other things, other areas if there's more turbulent economic conditions. So I'm really excited about the opportunity, the role that we play, and the fact that we're giving customers visibility that they can't get from any other set of capabilities. So that uniqueness for me gets me very excited about the future and the role that we can play with security.

I think what you're hearing partially is my voice just coming from a security background. I think we can elevate and emphasize some of those things within Splunk, and there's short-term opportunity there.

Raimo Lenschow -- Barclays -- Analyst

Yeah. And then one follow-up for Jason. If I look -- the question I'm getting from investors is around cloud. And like software companies are doing beat and race war.

If you look at your quarter, like cloud was kind of reconfirmed, is there anything that you want to point out in terms of from a macro perspective that you're seeing there? Is it just kind of early in the year? Just what's the take on the guidance -- on the different drivers for the guidance? Thank you.

Jason Child -- Chief Financial Officer

Sure, yeah. I would say, first, as it comes to cloud, very happy with the performance in Q1. Cloud mix of 57% was just up a tick over a year ago. But really, the motion for our cloud business really is tied very much due to -- or to the renewal base.

And our renewal base is the smallest in Q1, and it really starts to go throughout the year. So I would call -- we did reaffirm cloud guidance for full year at reaching the $2 billion number, which puts us in a pretty unique place and already imply strong growth. But we do expect, as you see the cloud mix grow throughout the year, I think we said last quarter and no change to our assumption that we expect cloud mix to be approaching 70% by year end, that we'll continue to see strength in the cloud business.

Raimo Lenschow -- Barclays -- Analyst

Perfect. That's super helpful. Congrats from me, and all the best, Gary.

Gary Steele -- President and Chief Executive Officer

Thanks, Raimo.

Jason Child -- Chief Financial Officer

Thank you.

Operator

Thank you. Our next question comes from the line of Phil Winslow from Credit Suisse. Your question, please.

Phil Winslow -- Credit Suisse -- Analyst

Hi, guys. Thanks for taking my question, and congrats on a great start to the year. And Gary, very excited to be working with you again. Gary, yes, we'll start with you.

Obviously, we've had a lot of questions on this call about security. But the other Splunk-built solution on top of the platform, observability. I wonder if you guys, just sort of your view on sort of what Splunk brings to the secured -- the observability market relative to some of the competitors, what really stood out to you? And how is sort of the integration of all those acquisitions coming? And then I got a follow-up for Jason on the numbers.

Gary Steele -- President and Chief Executive Officer

You got it, Phil. So one of the things that has been really interesting to me is to see the leverage that we're getting from these traditional security customers into observability. So the market opportunity is very simple in that when something goes bump in the night and there's an application failure, companies want to know, is that a security issue? Or is that just an application failure? And it's really looking at a lot of the same data. So we benefit from being able to have that insight.

And through that leverage, we're seeing lots of interest extending logs into metrics and traces to have a broader, more fully -- a full view of what's happening from an observability standpoint. So I feel like there's tremendous leverage. And to your point, relative to product, we're really the only vendor today out with logs, metrics, traces all integrated. So our progress on that has been tremendous.

And while we're still early in the market, we had some very nice wins in the quarter, and we're seeing the leverage that we have extending our footprint with the platform into the traditional observability market. So we feel really good about that positioning, and I think it represents a really nice growth opportunity over the coming years.

Phil Winslow -- Credit Suisse -- Analyst

Yeah. And then, Jason, a question for you. I often get this question on the DBNRR number in the cloud, obviously, super strong. And you still have continued growth in the non-cloud ARR base.

How much of that cloud DBNRR growth is coming from people sort of lifting and shifting from on-prem? Or is that still the vast majority, just call it net new? In other words, a clean sort of apples-to-apples DBNRR number?

Jason Child -- Chief Financial Officer

Yeah. The -- I mean, so overall, our overall DBNRR is growing within a few hundred basis points of the cloud DBNRR rate, that's been consistent for a while. If you then unpack how much of the cloud business is growing kind of on a durable basis without migrations, it's a little harder to figure that out, but our analysis indicates that it's maybe a couple of hundred basis points of tailwind, but not a material impact on the overall DBNRR number.

Phil Winslow -- Credit Suisse -- Analyst

Got it. So in other words, the growth dynamics are sort of dependent on the cloud itself versus migration? Great.

Jason Child -- Chief Financial Officer

That's right.

Phil Winslow -- Credit Suisse -- Analyst

Awesome. Thanks, guys. Keep up the good work.

Gary Steele -- President and Chief Executive Officer

Thanks, Phil.

Jason Child -- Chief Financial Officer

Thanks, Phil.

Operator

Thank you. Our next question comes from the line of Keith Weiss from Morgan Stanley. Your question, please.

Sanjit Singh -- Morgan Stanley -- Analyst

Thank you for taking the questions. This is Sanjit Singh with Morgan Stanley on for Keith. Gary, congrats on the role and really looking forward to working with you again. I have two questions, one for Jason, and then one for you, Gary.

Jason, on the guidance, I was wondering if you could walk us through maybe some of the underpinning assumptions around guidance with respect to closure rates or any other sort of metrics, and to what degree did you provide an extra layer of conservatism or prudence just given all of sort of the macro uncertainty that's going out in the market? Just walk us through those assumptions. And then for Gary, the question is really around what you sort of see the opportunity on the go-to-market side, you talked about flattening the organization. In terms of how fast should Splunk move to cloud versus continue to make this more of a choice for customers, what's the right balance for that when we think about the context of trying to improve operating margin and cash flow, sort of the pace of how this position move to cloud, I'd love to get at least your initial thoughts on that dimension.

Jason Child -- Chief Financial Officer

OK. So on the first question, I'm not going to be able to unpack it probably to the level that you would like for modeling, but I will tell you, there's kind of four primary pieces. And so as we look at either -- whether it's ARR or net new ARR, ACV, whatever, we start with an overall renewal rate, which we've consistently had at a very, very high percentage at the 90-ish percent range. And then we factor in what is our expectations on expansion.

And as you've seen with the DBNRR, that number has been relatively consistent. We then have to layer in the new logo expectations, which that's probably a little harder to do, especially if there is a slowdown in macro. And then lastly, expectations on churn, which is, I guess, kind of the inverse of that renewal rate, but that's usually been a pretty consistent single-digit percentage number. So across all those dimensions, we're not really seeing big changes, which is why we're reiterating the guidance and didn't change the numbers for full year.

And if something changes, we'll let you know, but at this point, we feel very good about the Q1 we delivered with a strong DBNRR, the RPO bookings of 32%, the revenue growth, highest revenue growth we've had in three years. So overall, I feel like the fundamentals are in very, very good position.

Gary Steele -- President and Chief Executive Officer

And to the other part of the question, one of the interesting things to think about is the way in which our largest customers want to deploy. And one of the things I've learned in my six weeks here is we see tremendous value in being able to support customers that have multi-cloud hybrid environments, which is almost every single large customer. They're operating across multiple clouds, and they continue to have significant operations on-prem. And so our ability to be able to bring all that together under a single architecture, provide federated search, so they can search from a single instance across all those environments is something that's super unique.

But in saying all that, it does create more complexity in what percentage it will ultimately be cloud. Because we do believe that over the long haul, these large customers will continue to maintain presence, again, in the cloud and on-prem. So we're not as hung up on what that exact number is because we understand that these large, incredibly strategic customers have complex environments that they need to be able to leverage Splunk in this broad hybrid world. Now to your question about efficiency on go-to-market side, I do believe that by flattening the organization, we can drive a level of agility and decision-making that helps us get closer to our customers, improves the customer experience, and, ultimately, I think, will be more in tune with helping them advance their architectures in this -- what is a very complex world.

And ultimately, we financially benefit from that. So I'm feeling incredibly excited about the role that we can play, drive customer experience and do it in a more efficient way than we've traditionally done it. So I'm, while I'm early days here, super optimistic about that.

Sanjit Singh -- Morgan Stanley -- Analyst

Really appreciate the thoughts, Gary and Jason. Thank you so much.

Gary Steele -- President and Chief Executive Officer

Thank you.

Jason Child -- Chief Financial Officer

Thank you.

Operator

Thank you. Our next question comes from the line of Kirk Materne from Evercore ISI. Your question, please.

Chirag Ved -- Evercore ISI -- Analyst

Hi. This is Chirag Ved on for Kirk. Congratulations on a great quarter, and Thanks for taking the question. Gary, maybe just one for you.

Could you talk about the potential to get greater scale and efficiency through partners and how you're continuing to engage with the ecosystem to help you scale? Thanks.

Gary Steele -- President and Chief Executive Officer

Yeah, no, it's a really good question. And I think it's an interesting point of leverage opportunity in the business. We've done a tremendous job of partnering with some of the largest GSIs in the world. We've seen very good early traction with the cloud players.

We also obviously play in the security world with the security resellers. And so there's a variety of communities where we're playing a critical role. And I think what's interesting here and the one thing that does differentiate Splunk is the opportunity to work with those partners where they can deliver services on the back of Splunk in these complex architectures, be it security or broader observability, it really creates a very compelling opportunity for partners. And I think we're at the beginning of that journey.

I think there's a lot more we can do. And it's something that I'm frankly super excited about diving in on and supporting the team in those efforts. But we're -- I think we're very early in that opportunity.

Chirag Ved -- Evercore ISI -- Analyst

Thank you.

Gary Steele -- President and Chief Executive Officer

Thanks, Chirag.

Operator

Thank you. Our next question comes from the line of Steve Koenig from SMBC. Your question, please.

Steve Koenig -- SMBC Nikko Securities -- Analyst

Great. Thank you. Hey, Gary, congratulations on the new role.

Gary Steele -- President and Chief Executive Officer

Thanks, Steve.

Steve Koenig -- SMBC Nikko Securities -- Analyst

I got two questions for you. So one is about competition with the XDR vendors. What's your view of the difference between XDR and SIEM other than having an endpoint agent? And then I'll hit you with the next one after that.

Gary Steele -- President and Chief Executive Officer

Yes. The one thing that I've seen here that I think is really important is in our SIEM world and the broad Splunk platform, we're able to take a vast variety of data to provide end-to-end visibility as to what the heck is happening in these complex environments. So as the attack surface has grown, having that broad visibility is absolutely critical, whether you're dealing with Log4j, you're dealing with the ransomware issue or you're dealing with some other vulnerability environment. And what is missing in the XDR world, it's a limited view.

And so customers absolutely today require this broad visible view. And I think one of the things that Splunk got right way before I got here is not discouraging customers on data. So with the workload-based pricing, getting access to all that data and making it available across multiple clouds, as well as hybrid, no one else can do that. And so I think we're in a very, very unique position relative to the XDR players.

Steve Koenig -- SMBC Nikko Securities -- Analyst

Got it. That makes sense. And then my follow-up is really about the context here. You've been working in cyber for many years.

And so I'm curious, your view, I understand the product leverage you get from playing across IT ops, DevOps, and SIEM. From a customer buying perspective, where are the security purchases dependent on IT budgets? And then where are they separate? And is there some difference between enterprise and smaller companies? And how Splunk's go-to-market work within that dynamic? Thanks very much.

Gary Steele -- President and Chief Executive Officer

Yeah. Really good question, Steve. And it's interesting because one of the things that I've been seeing, and I've been doing a lot of customer meetings, and so I've really been trying to get my arms around that exact question. And the thing that we see is sort of threefold.

First of all, we always have a strong champion in security because of the role and the dependence the security team has on Splunk. Second, the IT teams have traditionally gotten a tremendous amount of value giving them visibility across that broader application environment. And then as these new applications have been developed, leveraging modern cloud architectures, this requirement on having broader observability is absolutely critical. And so we really see kind of a -- we see two primary buyers.

We see CISO playing a critical role, and we see CTO playing a critical role. And they're oftentimes just working in concert with one another. And that leverage is amazing, and I just -- I've seen it in lots of different customer examples day in and day out. So I think we're extremely uniquely positioned here and it represents a tremendous growth opportunity for the future as a result.

Steve Koenig -- SMBC Nikko Securities -- Analyst

Got you. Great. Well, thanks, Gary, and good luck.

Gary Steele -- President and Chief Executive Officer

Thank you. appreciate it.

Jason Child -- Chief Financial Officer

Thanks, Steve.

Operator

Thank you. Our next question comes from the line of Matt Hedberg from RBC Capital. Your question, please.

Matt Hedberg -- RBC Capital Markets -- Analyst

Great. Thanks, Gary. Congrats and really look forward to working with you again.

Gary Steele -- President and Chief Executive Officer

Thanks, Matt.

Matt Hedberg -- RBC Capital Markets -- Analyst

So I guess you guys have obviously a blue chip list of customers and have made a tremendous push with Splunk Cloud. How do you think about accelerating new customer lands? It's been more of an upsell into the base, but that new customer land piece, how do you think about that?

Gary Steele -- President and Chief Executive Officer

Yeah. I think it comes in a couple of dimensions. I think in the world we're living in relative to the requirements around security, I think Splunk plays a critical role, and we'll continue to run the play of getting customers to adopt us as the core to their overall security strategy. I think that's one.

Two is we're seeing tremendous interest on the durability side, we're landing customers in that regard as well. And we had some nice wins, a couple of which we talked about in the prepared remarks. So I think that motion, I think there's more work we can do there, but I think the motion is in place.

Matt Hedberg -- RBC Capital Markets -- Analyst

Got it. OK. And then maybe for yourself or Jason. Speaking about the base, obviously, you have a large renewal opportunity this year.

Can you talk about the health of the large deal pipeline and maybe some of the close rates that you saw and maybe some of the assumptions you're making for Q2?

Jason Child -- Chief Financial Officer

Yeah. On the renewal base is certainly the smallest in Q1 of any of the quarters this year. But I'd say in terms of closing deals, pretty much we're right on track in terms of -- we do track loss ratejt really seeing any real shift there. I would say this is a pretty significant step-up in the renewal base, over doubling from -- to about $1.5 billion this year.

And it's going to keep growing throughout the year progressively each quarter. But feel like we have a great start to the year, and all the indications look strong at this point.

Matt Hedberg -- RBC Capital Markets -- Analyst

Great. Thanks a lot. Congrats, guys.

Gary Steele -- President and Chief Executive Officer

Thank you. 

Jason Child -- Chief Financial Officer

Thanks, Matt.

Operator

Thank you. Our next question comes from the line of Keith Bachman from BMO. Your question, please.

Keith Bachman -- BMO Capital Markets -- Analyst

Hi. Many thanks. And I also want to ask two questions, and Gary, I'm going to start with you on the first one. Really great to hear about your orientation on improving margin, particularly free cash flow margin.

With that said, one thing you mentioned was not replacing Shawn. And I wanted to hear a little bit more about what the plan there. I think there's been perhaps some go to -- or product development go-to-market kind of execution issues. And I would call out observability, while you called out some wins, I mean, feedback from the channel on observability is it still requires some integration work.

And I'm just curious as to what your plan is, if you're not going to backfill Shawn, how do you make sure that Splunk continues to innovate well to try to capture opportunities?

Gary Steele -- President and Chief Executive Officer

Yeah, no, it's a great question. One of the things I'm actually personally super excited about is rolling up my sleeves and working closely with the engineering leaders to drive higher speed, agility, and faster pace of innovation. And Splunkers here have done an amazing job historically. And I think that with some support driving decision-making, we can be in a really good position.

And so I love to get my hands dirty and work directly with the engineering teams. And so I think that we're really well-positioned to do that with a flatter organization. So I think it's a -- it will be a change, but I think it's a very -- it will be a very positive change for the company.

Keith Bachman -- BMO Capital Markets -- Analyst

OK. Obviously, a critical one. And my second question relates to that is the typical refrain, as I'm sure you've gathered from investors, is that Splunk is losing share to a variety of competitors that are encroaching -- increasingly encroaching on the space. Now it's easy to understand how your gross retention is very, very high.

But what's your take from what you've heard from customers in terms of workload retention? That is to say on winning new applications or winning new logos is the previous question. But could you talk a little bit about kind of your first quarter here of Splunk as how you view the competitive dynamics and Splunk's ability not only to maintain your customers, but more importantly, to keep growing your workloads to keep driving kind of 30-plus percent revenue toward type of growth? That's it for me. Many thanks.

Gary Steele -- President and Chief Executive Officer

Yeah, no, it's a good question. So in the time that I spent here, I've probably done, I don't know, maybe 40 customer meetings. And in all those customer meetings, every single one of them, we spent time talking about expansion of Splunk and new workloads where they've identified use cases where they want to leverage the power of Splunk to try to drive additional value for them. So I think the reality is Splunk is playing in this massive market, which is estimated, on our estimates, it's about $100 billion.

And of course, there are other players going after that, but we're uniquely positioned to go continue to win these workloads given the loyal nature of these -- of our customers, the new customers we're signing, and the fact that we continue to see growth in the workloads that they're putting on Splunk. So I think there's obviously lots of noise in the market, but I think we're incredibly well-positioned, and I hear it directly from customers. And that's where I spent my time over my first six weeks.

Jason Child -- Chief Financial Officer

Yeah. The only thing I would add is just to restate the net retention. I mean net retention out only is 130. And then overall, it's worth a few hundred basis points, so call it high 120s.

And that's including any competitive anything because that's net of churn. So there may be chatter in the market, but feel pretty good about stacking up the DBNRR against anyone else at our size or close to it and feel like the numbers speak for themselves.

Keith Bachman -- BMO Capital Markets -- Analyst

All right. Jason, many thanks.

Jason Child -- Chief Financial Officer

Thanks, Keith. Hope you feel better.

Operator

Thank you. Our next question comes from the line of Brad Sills from Bank of America Securities. Your question, please.

Brad Sills -- Bank of America Merrill Lynch -- Analyst

Oh, great. Thanks for taking my question. Congratulations, Gary, on your new role and nice first quarter as CEO.

Gary Steele -- President and Chief Executive Officer

Thank you.

Brad Sills -- Bank of America Merrill Lynch -- Analyst

I wanted to ask about just the platform itself. There's been a lot of effort, a lot of investment made in retooling for the cloud, adding observability. Do you feel like the platform is in a place now where it needs to be? And from here, it's just kind of incremental improvements on those two in particular? Or are there some other efforts here that we should be thinking about as you continue to broaden the platform?

Gary Steele -- President and Chief Executive Officer

No. I think when I look at current state of capabilities today, the one thing I'm encouraged by is the amount of progress that's been made prior to me joining. And we're excited next week, we have some exciting product announcements at .conf, which really play into this exact question. So stay tuned on that.

Brad Sills -- Bank of America Merrill Lynch -- Analyst

Wonderful. Thanks so much. And then, Jason, one for you, please. It looks like you're kind of tracking close to that ARR margin target this year, fiscal '23, that you laid forth a couple of years ago.

The operating cash flow margin of ARR is quite a bit lower at that greater than $400 million level. Is there any reason to think that free cash flow couldn't come back more meaningfully than kind of where you've guided to this year? I guess where could we see upside potentially with free cash flow conversion as we move through the year?

Jason Child -- Chief Financial Officer

Yeah. Well, I would say our free cash flow conversion, I mean I think I've talked about in the past couple of quarters, there's a lot of puts and takes. And certainly, cloud gross margin is probably the biggest driver of -- because there's been a lot of complexity on migrations, which has short-term margin pressure as you get through the migrations. And then once you're past the migration, you can kind of dial up elasticity when you have a better understanding on exactly what utilization looks like on a by- customer basis.

So in terms of getting back to the kind of 20-plus percent cash yield, it's definitely a question of when, not if. Don't have a specific time frame on that yet. At some point, we'll be able to give you some better future guidance. But the timing really is going to be tied mostly to kind of the cloud migration and then cloud margin timing.

And that's when you'll see the cash yield get to that 20-plus percent rate that we talked about a couple of years ago.

Brad Sills -- Bank of America Merrill Lynch -- Analyst

That's great. Thanks so much, Jason.

Jason Child -- Chief Financial Officer

Thanks, Brad.

Gary Steele -- President and Chief Executive Officer

Thanks, Brad.

Operator

Thank you. Our next question comes from the line of Michael Turits from KeyBanc. Your question, please.

Michael Turits -- KeyBanc Capital Markets -- Analyst

Hey, everybody. So, Gary, congrats on joining the company and on the role. One philosophical one for you, I think, Gary, on pricing. Splunk's been down for a while.

Or at least customer feedback has been that pricing is high, it's difficult, but there's a structure to it. And have made changes. Do you think they're there yet in terms of doing what needs to be done to convince customers that pricing gives them value? And then I have a broader question for I think maybe, Jason, both and Gary.

Gary Steele -- President and Chief Executive Officer

Yeah, I do. Great question. The move from ingest-based pricing to workload-based pricing has been incredibly important and strategic to customers. So it really now is encouraging customers to more broadly leverage their data.

This is important as we think about the role that Observability plays as well. It's important from a security point of view because you have broader access to all the data that you really need to have insight into. And so I think there is some hangover. I think there's some -- still some sting out there.

But the feedback on workload-based pricing has been very, very good. And as you think about cloud, all the largest deals are all workload pricing. So I think we've made very good progress, and it's been a journey, but I think we've been making good progress on this.

Michael Turits -- KeyBanc Capital Markets -- Analyst

Great. Thanks. And then the follow-up, I guess, for both of you guys, in a way for Jason because he's been through this with Splunk before. But on the macro side, I mean, just now on another data call, there's comments about consumption getting weaker in this environment.

And Jason, you went through this in '20 where things seemed fine at first, but in some senses go weaker at some point a couple of quarters later. So are you either seeing anything or anticipating and changing your tactics in any way such to anticipate either smaller deals, longer sales cycles, or, as we're hearing from other data provider today, lower consumption rates?

Gary Steele -- President and Chief Executive Officer

Yeah, no, that's a good question. I'll start, and Jason will have a couple of comments as well. It's interesting. We watch very closely at the close of the quarter.

So I joined two weeks prior to the end of the quarter, so I had the opportunity to see the dynamics of all deals as they lined up as we closed the quarter. And we literally heard no one talk about changing financial priorities, budgets pulled, projects pulled. We heard none of that. Literally, absolutely none of it.

Now we're obviously being cautious given the broader set of market conditions, but we saw no change in buyer behavior as we worked our way through the end of the quarter. And, Jason, I'll let you dive in.

Jason Child -- Chief Financial Officer

Yeah. On the -- on overall basis, we did obviously take up our guidance on revenue and op margin, but we maintained ARR and cash flow. And I would say, from what I saw in the quarter and what we're assuming as we are now well into Q2 is not really any big changes. And I think, certainly, what we saw a couple of years ago was very pronounced and very immediate.

I don't see anything like that. Our assumptions really are the growth for the balance of the rest of the year. I think the biggest swing factor we're still trying to understand is to what extent our large-scale cloud migrations affected. And we'll learn more about that as we progress throughout the year because, as I said earlier, the renewal base really kind of steps up each quarter and really kind of peaks in Q4.

But so far, haven't really seen any real significant macro impacts.

Michael Turits -- KeyBanc Capital Markets -- Analyst

Thank you.

Jason Child -- Chief Financial Officer

Thanks, Michael.

Operator

Thank you. Our final question for today comes from the line of Rob Owens from Piper Sandler. Your question, please.

Rob Owens -- Piper Sandler -- Analyst

Great. Thanks for taking my question. I want to add on to Michael's question. I guess, just through the lens of headcount growth and hiring and whether you're going to hire ahead or you're being a little bit more conservative in this environment?

Jason Child -- Chief Financial Officer

I would say, from a CFO's perspective, we're a growth company. We have a forecast that we're maintaining from a growth perspective. So we're going to continue to be hiring certainly on the selling capacity side. And we still do have a platform that we're in fairly well into the process of modernizing, but there's still work to do, especially on the observability side.

So we're going to be making investments in those areas, and I don't expect that to change. Anything else, Gary?

Gary Steele -- President and Chief Executive Officer

No. And I think, Rob, it's good to talk you again. I would say when we look at the overall hiring environment, etc., we're being thoughtful about it, but we're not tapping the brakes at this point.

Michael Turits -- KeyBanc Capital Markets -- Analyst

All right. Thank you.

Gary Steele -- President and Chief Executive Officer

Thanks. Rob.

Operator

Thank you. This does conclude the question-and-answer session of today's program. I'd like to hand the program back to Gary Steele for any further remarks.

Gary Steele -- President and Chief Executive Officer

Let me reiterate that this is the best time to be here at Splunk. As our momentum demonstrates, we are mission critical to our customers' operations already, and there's a massive market opportunity to provide a foundation of security and resilience, so customers can innovate with speed and agility. I'm looking forward to working with customers, partners, and employees to use Splunk to help reach even more mission-critical outcomes. Thank you, all, for your support and hope to see you at .conf.

Operator

[Operator signoff]

Duration: 54 minutes

Call participants:

Ken Tinsley -- Corporate Treasurer and Vice President of Investor Relations

Gary Steele -- President and Chief Executive Officer

Jason Child -- Chief Financial Officer

Kash Rangan -- Goldman Sachs -- Analyst

Brent Thill -- Jefferies -- Analyst

Brad Zelnick -- Deutsche Bank -- Analyst

Raimo Lenschow -- Barclays -- Analyst

Phil Winslow -- Credit Suisse -- Analyst

Sanjit Singh -- Morgan Stanley -- Analyst

Chirag Ved -- Evercore ISI -- Analyst

Steve Koenig -- SMBC Nikko Securities -- Analyst

Matt Hedberg -- RBC Capital Markets -- Analyst

Keith Bachman -- BMO Capital Markets -- Analyst

Brad Sills -- Bank of America Merrill Lynch -- Analyst

Michael Turits -- KeyBanc Capital Markets -- Analyst

Rob Owens -- Piper Sandler -- Analyst

More SPLK analysis

All earnings call transcripts