Logo of jester cap with thought bubble.

Image source: The Motley Fool.

Splunk (SPLK)
Q2 2024 Earnings Call
Aug 23, 2023, 4:30 p.m. ET

Contents:

  • Prepared Remarks
  • Questions and Answers
  • Call Participants

Prepared Remarks:


Operator

Good afternoon. My name is Krista, and I'll be your conference operator today. At this time, I would like to welcome everyone to the Splunk second quarter 2024 financial results conference call. All lines have been placed on mute to prevent any background noise.

After the speakers' remarks, there will be a question-and-answer session. [Operator instructions] I will now turn the call over to Katie White, director of investor relations. Please go ahead.

Katie White -- Director, Investor Relations

Thank you, Krista. Good afternoon, and thank you for joining today's call. With me on the call are Gary Steele, president and CEO; and Brian Roberts, CFO. After market closed today, we issued our earnings press release, which is also posted on our investor relations website along with supplemental material.

This conference call is being webcast live. And following the call, an audio replay will be available on our website. On today's call, we will be making forward-looking statements including financial guidance and expectations including our growth and profitability; forecast for our third quarter and full year fiscal 2024; and our future expectations of revenue, total ARR, cloud mix, non-GAAP operating expenses, non-GAAP operating margin, free cash flow, free cash flow margin, cloud DBNRR, cloud gross margin, equity compensation usage, and liquidity, as well as trends in our markets and our business, our strategies and expectations regarding our business, AI, acquisitions, products, technology, customers, demand, and regulatory environment. These statements are subject to risks and uncertainties and are based on our assumptions as to the macroeconomic environment and reflect our best judgment based on factors currently known to us.

10 stocks we like better than Splunk
When our analyst team has a stock tip, it can pay to listen. After all, the newsletter they have run for over a decade, Motley Fool Stock Advisor, has tripled the market.* 

They just revealed what they believe are the ten best stocks for investors to buy right now... and Splunk wasn't one of them! That's right -- they think these 10 stocks are even better buys.

See the 10 stocks

*Stock Advisor returns as of August 21, 2023

Actual events or results may differ materially. Please refer to documents we filed with the SEC, including our Form 10-K and 10-Q, as well as the Form 8-K filed with today's press release. These documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward looking statements are being made as of today, and we disclaim any obligation to update or revise these statements.

If this call is reviewed after today, the information presented during this call may not contain current or accurate information. We will also discuss non-GAAP financial measures which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website. So, with that, let me turn it over to Gary.

Gary Steele -- President and Chief Executive Officer

Good afternoon, and thank you for joining today's call. To start, Splunk delivered a solid second quarter. Through our ongoing focus on execution, operational discipline, and customer engagement, we met or exceeded each of our guided metrics in Q2. I'm really pleased with these results and want to thank the entire Splunk team for their hard work and commitment.

At the same time, we further accelerated Splunk's innovation to help our customers achieve resilience across their digital systems through a series of important and exciting announcements. I'll cover our financial results first. Since joining Splunk 16 months ago, we've been executing to drive long-term durable growth with increasing profitability. Our Q2 results yet again showcased our ability to deliver on that strategy, particularly through ARR and free cash flow growth, which we believe are the best top- and bottom-line metrics of the health and strength of our business.

In Q2, we grew total ARR to $3.858 billion, a 16% year-over-year increase, exceeding the guidance we shared on our last earnings call by over $30 million. Cloud ARR increased 27% year over year to $1.918 billion. And our Q2 total revenue grew to $911 million, a 14% year-over-year increase, well above our previously guided range. We delivered our top-line growth while maintaining a sharp focus on operating efficiency and controlling costs.

In fact, that focus enabled us to reduce non-GAAP opex by 3% year over year, which is significant given that we previously anticipated an increase of between 2% and 2.5%. What's more, we exceeded expectations for free cash flow in Q2, delivering positive 4 million, nearly 20 million above our guidance. Given our considerable progress on driving more efficient growth, we are increasing our full year outlook for free cash flow. Brian will share our updated guidance shortly.

We're proud of what we delivered this quarter even as the uncertain macro environment remain largely consistent with what we've seen throughout this year. Our Q2 performance clearly demonstrates that we have dialed in our ability to navigate the current landscape and execute with consistency to deliver durable growth and profitability. What's also evident is that organizations around the world need Splunk's world-class, unified security and observability platform more than ever to underpin the resilience of their digital systems. Since becoming CEO, one of my top priorities has been to increase the pace of our innovation.

As the technology landscape evolves and becomes more complex, organizations need to see and understand what's happening in their environments in order to keep their systems safe and reliable. In the simplest sense, if you can't see it, you can't secure it, you can't keep it up and running either. I hear time and time and again from CISOs, CIOs, and CTOs that Splunk's commitment to providing comprehensive visibility into and across environments is critical in today's hybrid multi-cloud world. I'll spend the next few minutes sharing how we're deepening that commitment by taking you through what we announced in July at the Splunk's annual user conference, .conf23.

During our last earnings call, I spoke about our enthusiasm that AI would fundamentally transform the way organizations keep their digital systems secure and reliable. Given Splunk's flexible and highly scalable data architecture, our industry-leading security and observability solutions and our quickening pace of innovation, we are in a unique position to help enterprises bolster resilience by harnessing AI across our product portfolio. During .conf23, we unveiled the next step in how Splunk is bringing AI to bear across security and observability. Splunk AI is a collection of new and existing AI-powered offerings that combines automation with human-in-the-loop experiences so organizations can drive faster detection, investigation, and response while controlling how AI is applied to their data.

By optimizing domain-specific large language models and machine learning algorithms built on security and observability data, Splunk AI frees up security and engineering teams for more strategic work, helping to increase productivity and lower costs. In addition, we're applying AI to help teams accelerate time-to-value through assisted intelligence. Our new Splunk AI system leverages generative AI to provide an immersive chat experience and helps make our search processing language, or SPL, are easier to use by enabling the use of natural language to create SPL queries. We're excited that Splunk AI will continue building on our track record of innovation in AI and ML.

This includes our recently launched app for anomaly detection that uses ML and are widely used machine learning toolkit. Looking forward, we see broad opportunities to further apply to make AI our core platform and premium products that much more powerful through advanced functionality. At .conf, we also introduced many new products and features that empower security, IT, and engineering teams with unified experiences and workflows so they can detect, investigate, and respond to threats quickly, accurately, and at scale. In security, we announced multiple new features for our award-winning enterprise security and server products, and we also announced the general availability of Splunk Attack Analyzer, which integrates the capabilities we acquired from TwinWave last year into our unified security operations experience.

Splunk Attack Analyzer is already being used by some of the world's largest companies to analyze threats, including those that employees reported as suspected phishing emails. During an integration with Splunk SOAR, customers that are using Splunk Attack Analyzer and SOAR can fully automate the threat analysis process to ensure accurate and timely detections while reducing the time and resources typically spent doing manual investigations. We also shared our continued delivery on our unified security operations center vision, which aligns to the threat detection, investigation, and response, or TDIR framework. The cornerstone of our approach is Splunk Mission Control, which brings together security and analytics, automation and orchestration, and threat intelligence capabilities under one common work service, empowering security teams to stay ahead of cyberthreats.

By unifying, simplifying, and modernizing how Splunk is in SOC, we're helping teams overcome the challenge of having too many disparate tools too little time, and nonstop threats and alerts coming across their console. On the durability side, we were named a leader in the 2023 Gartner Magic Quadrant for application performance monitoring and observability. This recognition builds on our nine consecutive times of being named a leader in the 2022 Gartner Magic Quadrant for security information and event management. Today, Splunk is the only vendor to be named a leader in both the Gartner Magic Quadrants.

Our goal is to create a single unified experience for security, IT, and engineering teams across security and observability. To that end, we continue to unify Splunk Observability Cloud with the Splunk platform. In 2022, we launched Splunk Log Observer Connect, enabling Observability Cloud users to seamlessly use their Splunk enterprise and Splunk Cloud platform data. We didn't stop there.

In Q2, we previewed the OpenTelemetry Collector as a technical add-on, which provides customers with a unified view of their infrastructure and services. We also launched Unified Identity to give our customers a better user experience as they access data from the Splunk Cloud platform and Splunk Observability Cloud without the need to authenticate multiple times. Looking ahead, we're continuing to invest in the enterprise-grade observability solutions organizations need to monitor and troubleshoot across the entire tech stack. A guiding factor in our innovation is a belief that organization shouldn't be locked into one environment and should have choice in how they architect their systems across the multi-cloud hybrid world.

We're continuing to find ways to make sure that Splunk is available natively to customers in the cloud environments that work best for them. That's why one of the most exciting announcements at .conf was our new strategic partnership with Microsoft to build Splunk's cloud solutions natively on Microsoft Azure. Together, our approach will enable our joint customers to migrate, modernize, and grow their environments with end-to-end cloud and hybrid visibility at scale. In addition, organizations globally can now purchase Splunk Enterprise, Splunk Enterprise Security, and Splunk IT Service Intelligence in the Azure Marketplace.

We're powering thousands of our joint customers with best-in-class solutions, and I'm glad to share that the first transaction closed in Q2 was a boomerang customer returning to Splunk, thanks to the flexibility and value our approach provides. Another area where we're continuing to invest is in driving innovation at the edge, given the explosion of data processing information on the edge has become a critical priority both for Splunk and our customers. Last quarter, we launched Splunk Edge Processor, which helps our customers process data at the edge to increase visibility and control over their data before it leaves their network and helps ensure that it ends up at the right destination in the right format. We know this is an essential capability and we are proud to offer Edge Processor for free to our Splunk Cloud customers edges.

As Edge Processor is adopted by our customer base, we believe it will significantly reduce the need for customers to leverage external vendors to preprocess their data. Related to this, a few of you have asked us about our ongoing lawsuit against Cribl. Although my ability to comment on active litigation is limited, I can tell you that the litigation is very active and the case is scheduled to go to trial in April of 2024. You may recall that this case is about Cribl taking and illegally using our intellectual property.

And indeed, Cribl has conceded that it reverse engineered features in Splunk's software. Our case is strong, and we look forward to continuing to prove it. Shifting back to our edge innovation, another exciting announcement during the quarter was Splunk Edge Hub, which provides more complete visibility across IT and IoT environments by streaming previously hard-to-access data directly into the Splunk platform. For manufacturers, factory floors, server rooms and more, Edge Hub simplifies the ingestion and analysis of data generated by sensors, IoT devices, and industrial equipment, enabling advanced monitoring, investigation, and response.

Edge Hub is sold exclusively through our go-to-market partners who bring deep industry expertise on our customers' IT environments. And I'm pleased to share we're seeing compelling customer use cases from early adopters. For example, a multinational manufacturing company uses Edge Hub to interface with their production systems to collect machine data to classify defects. With over 1 million annual consumer device production capacity, this organization is continuously looking for incremental quality improvement opportunities to save costs and assess factory expansion needs for increases in customer demand.

After deploying Edge Hub, the organization achieved a reduction of approximately 70% in defective parts during their QA process, resulting in more than 20% labor cost savings associated with otherwise scrapped or reworked products. We're excited to have once again broken down a barrier for our customers to gain more visibility into their data, and we're looking forward to building on Edge Hub's early success. Let's change gears and highlight the continued demand we're seeing from customers around the world. We ended Q2 with 834 customers with $1 million or more in ARR, up by 24 just last quarter.

This includes 452 customers with cloud ARR over $1 million, which is up by 100 year over year from the 352 cloud customers with ARR over $1 million in the year-ago period. Our team landed many significant deals in Q2 that illustrate our growth levers and the breadth of value we bring to the largest and most complex global enterprises. I'll start with observability. Since 2018, we've built, acquired, and integrated what we believe are the best technologies to help enterprises monitor, operate, and improve their hybrid technology environments.

Our rapid innovation and investments in observability are paying off for Splunk and our customers. We're continuing to win significant deals and displace leading competitors by offering customers comprehensive observability solutions in a unified experience. During Q2, we were pleased to secure a seven-figure observability deal and extend our footprint within a leading U.S. financial services organization.

This customer needs to close their visibility gaps and requires a complete hybrid platform solution that eases resource constraints and consolidates their observability tools and costs as they prepare to move more than 150 applications to the cloud. We were already the trusted security provider. And through a technical proof of concept, we demonstrated not only the observability features needed for their transformation and full visibility, but also the vital platform integration capability to complement their existing use of Splunk and help them avoid tools for all, data silos, and waste. In Q2, a U.S.-based multinational conglomerate and long-standing hybrid security customer significantly expanded their use of Splunk by shifting more of their workload to cloud and through a new seven-figure, three-year observability deal for the new healthcare division and cloud stack.

They chose Splunk Observability over competitive options because of our ability to drive lower total cost of ownership and because our differentiated capabilities offer full visibility by using not only metrics and traces, but also underlying logs, helping enhance resilience by proactively preventing outages while also monitoring critical infrastructure. And applications? The market for observability is growing rapidly, and only Splunk has the integrated enterprise-grade solutions needed by the IT and engineering teams of the Global 2000 to keep their services up and running. Now, turning to security, since joining Splunk, I've led the team to deliver better outcomes and more value to our customer security leaders by making the work of their security teams that much more effective and efficient. During the quarter, we continue to see strong demand for our industry-leading SIEM and premium security solutions needed in the modern SOC.

In Q2, we secured a significant cloud deal with a global leader in transport and logistics. Following a competitive selection process, this European -- Europe-based organization chose Splunk to support and consolidate its complex security needs on a global level. This seven-figure Splunk Cloud and Splunk Enterprise Security deal displaced a legacy SIEM competitor and as a result of our growing strategic partnership to help them drive resilience through our single unified platform. We also secured a new logo win during Q2 in Europe for Splunk Cloud and Splunk Enterprise Security with a global automotive technology company.

The customer chose Splunk over competitors due to limitations in their legacy SIEM and because of our ability to provide full visibility across all of its data sources from over 150 sites globally. The organization is expanding rapidly in software development and with 200,000 employees now counts on Splunk to keep their systems safe and reliable as they scale. Our public sector momentum also continued in the quarter with an eight-figure security expansion and renewal with a large U.S. federal agency that is all-in on Splunk.

They have centralized their modernization and cybersecurity operations strategy around Splunk and are also delving into both AIOps and ITOps with us. As of Q2, they ingest 30 times more data per day than they did in 2019, leveraging hundreds of SIEM use cases, as well as several of our premium applications, including nearly 50 SOAR automation playbooks. Our work with government agencies is incredibly important, and we're proud of our partnership with this agency to advance their security operations to keep public information safe from threat actors while ensuring a world-class user experience across several applications. Looking ahead at security, we fundamentally believe that Splunk will continue to play a critical role in helping organizations navigate the evolving cybersecurity landscape.

One important example where our innovation and security leadership will be essential is helping our U.S. public company customers comply with the SEC's recently announced rules on cybersecurity incident disclosure that will be effective later this year. With a four business day window to report when a cybersecurity incident is deemed material, timely response is essential. Splunk's strength is detection and response and the investigative capabilities we provide can help customers quickly gather and analyze telemetry from various tools and sources to classify an event and determine if it's material and requires SEC reporting.

Our ability to see across vast quantities of data helps organizations quickly understand not only if something happened, but also how it happened. We believe our security solutions will be even more critical as organizations invest in broader resilient strategies to mitigate future cyberthreats and improve visibility into their IT infrastructure and accelerated detection and response. This is yet another dimension of value we bring as a strategic partner to our customers, executives as the cybersecurity landscape evolves. Finally, our customers can continue to tell us there's incredible value when they utilize both security and observability to solve their complex visibility challenges.

During the quarter, we deepened our strategic partnerships with many organizations on their path to greater resilience through unified security and observability. We secured a seven-figure security and observability deal in Q2 with a multinational banking and financial services company headquartered in the Asia-Pacific region. This milestone, renewal and expansion deal, took place in a highly competitive landscape, and it represents the deep level of engagement in our partnership over several years. We previously transitioned this organization from on-prem to the cloud.

And now, our momentum continues as they double down on our security and implement observability to meet their evolving needs. To wrap up, I want to reflect on the journey Splunkers and I have been on for the past 16 months. When I joined Splunk, my thesis was that we could accelerate Splunk's 20 years of industry leadership to deliver even more exceptional customer and shareholder value. I since led the team to build more executive-level customer relationships.

We are a vital strategic partner to customers worldwide, and we are focused on serving their expanding needs by increasing the pace of innovation. Along the way, we have cultivated the leadership and talent needed to drive durable growth with increasing profitability. Our results demonstrate that. My thesis is proving out and that Splunk is the key to enterprise resilience.

Thank you again for joining today's call. Now, over to Brian to walk through our financial results and outlook.

Brian Roberts -- Chief Financial Officer

Thanks, Gary. So, let's get to our financial review and outlook. We continue to successfully navigate this economic backdrop and close a solid quarter as we exceeded our met our outlook across all guided metrics. We increased total ARR by 16% year over year to $3.858 billion, above our prior outlook of 15% growth.

Cloud ARR increased 27% year over year to $1.918 billion. Cloud DBNRR, which is a trailing 12-month metric, was 116%, which was in line with our expectations. Remember cloud migrations began to slow in July of last year which impacts this trailing 12-month metric. In terms of mix, the cloud portion of Q2 software bookings came in at 64%, near the top end of our quarterly outlook of between 55% and 65%.

Q2 total revenue increased 14% year over year to $911 million, ahead of our guidance range of between $880 million and $895 million. Cloud revenue increased by 29% year over year to $445 million. With regards to cloud gross margin, we continue to make progress on our efficiency initiatives. Q2 non-GAAP cloud gross margin reached 73.8%, an all-time quarterly record, which is up nearly 450 basis points year over year and better than our outlook.

Now, let's move to operating expenses. Q2 was a milestone quarter. It was a showcase of our strong collaborative execution. We asked teams to find new unlocks, and they rose to the challenge.

They identified new opportunities to reduce third-party spend, as well as expand scope for team members, which helped us decrease costs and increase operating efficiency. As a result, we were able to reduce non-GAAP opex by 3% year over year instead of the previously expected increase of between 2% and 2.5%. And we achieved this while growing ARR by 16% year over year ahead of our outlook. The significant cost leveraging, combined with our revenue beat, helped to exceed our guidance on non-GAAP operating margin.

In Q2, we achieved a 16.7% non-GAAP operating margin, which was 470 to 670 basis points above our guidance of between 10% and 12%. Let's move to free cash flow. Remember, Q2 is seasonally impacted, given it follows our typically slowest bookings quarter, which is historically led to negative quarterly free cash flow. In Q2, we exceeded expectations and generated $4 million of positive free cash flow, which is $19 million ahead of our guidance.

Given the seasonality of bookings, we recommend that investors evaluate free cash flow on a trailing 12-month basis, which totaled $805 million at the end of Q2, nearly quadruple the $216 million generated over the 12 months ending July 31, 2022. Before I move to guidance, I am pleased to announce that we will host our investor and analyst day in New York City on January 9th. We are excited to share our strategy, long-term targets, and capital allocation plan with you. More details will follow as we approach the date.

And with that, let's turn to guidance. The current selling environment remains uncertain. We continue to experience increased scrutiny on deals, as well as delayed cloud migrations. That said, we're pleased with our first-half execution, navigating this macro backdrop.

Based on our progress to date, we're increasing the low end of our ARR outlook to $4.15 billion. In terms of the high end, until we see a positive change in the macro environment, we believe it's prudent to hold it unchanged at $4.175 billion. Separately, we are increasing our annual revenue outlook to a range of between $3.925 billion and $3.95 billion, up from our prior single-point estimate of $3.9 billion, an increase of $25 million to $50 million. Please recognize that duration and mix of term contract volume could significantly impact reported revenue and associated growth rates.

I want to remind investors that our software license revenue related to term contract volume is recognized upfront. Thus, GAAP revenue is highly subject to both bookings mix and contract duration. As a reminder, we believe ARR is a better top-line indicator since we bill both cloud and term software license customers on an annual basis. So, let's move to expenses and the impact on free cash flow.

We remain laser-focused on improving our margin profile. We made outstanding progress in the first half. And looking forward, we remain extremely focused on unlocking additional savings and efficiencies. As a result, we are updating our annual expense guidance as we now expect to manage annual non-GAAP opex growth below our prior outlook.

At the beginning of this fiscal year, we provided an outlook for annual non-GAAP opex growth of 7%. Last quarter, based on Q1 progress, we changed our guidance to between 5% and 6% growth. And we now have a new outlook. We expect that we can hold non-GAAP opex growth in fiscal '24 to approximately 2.5%, which represents a 450 basis-point improvement from our original outlook at the beginning of the year and a 300 basis-point improvement from the midpoint of our outlook provided just one quarter ago.

In terms of the impact on margins, we now expect a fiscal '24 non-GAAP operating margin of between 21% and 21.5%, up 300 basis points from our prior guidance range. Based on our successful expense management, we're also increasing our annual free cash flow forecast by an additional $50 million. We now expect to generate free cash flow between $855 million and $875 million in fiscal '24, which represents a year-over-year increase between 100% and 105% from the $427 million generated in fiscal '23. As a percentage of ARR, this would represent a free cash flow margin of between 20.6% and 21%, up from just 11.6% in fiscal '23.

Let's move to near-term guidance. In Q3, we expect to grow ARR by over $120 million to $3.98 billion, which represents 15% year-over-year growth. With regard to bookings mix, it's important to note that the U.S. public sector has historically had an outsized impact on our business in Q3, given the federal fiscal year-end of September 30th and typical purchasing patterns.

The majority of our public sector business remains on-prem, and they expect renewals and expansions in Q3 will impact the cloud mix of software bookings. So, while we continue to expect the cloud mix of software bookings will range between 55% and 65% each quarter, we will likely be toward the bottom end in Q3 after reaching the top end in Q2. Trailing 12-month cloud DBNRR should tick down by approximately 400 basis points and roughly stabilize in that vicinity for the remainder of the year. I am pleased to share that we now expect to achieve an important milestone early.

We previously indicated that cloud services would represent the majority of total ARR in the second half of the year. We now expect to achieve this during Q3. Let's move to revenue. We expect revenue between $1.02 billion and $1.035 billion in Q3, representing year-over-year growth of approximately 10% to 11%.

With respect to non-GAAP cloud gross margin, we expect it will be relatively flat quarter on quarter as we focus on improving service levels and customer experience. This would still represent approximately a 100 basis-point improvement year over year. We continue to expect that we can achieve non-GAAP cloud gross margins of roughly 74% in Q4. We expect Q3 non-GAAP opex growth to range between 4 and 5% year over year as we begin to comp some of the cost actions we took last year.

This opex growth translates into an expected Q3 non-GAAP operating margin of between 24.7% and 25.3%. Let's move to cash flow. In Q3, we expect to generate $75 million of free cash flow. This implies free cash flow of $834 million for the 12 months ending October 31, 2023, which is nearly triple the $287 million of free cash flow for the 12 months ending October 31, 2022.

We then expect to generate approximately $300 million of free cash flow in Q4. Again for the full year, we expect free cash flow between $855 million and $875 million, which is an increase of $50 million compared to our guidance range provided last quarter. Let's move to equity. As I mentioned last quarter, we're taking deliberate steps to reduce equity dilution.

In fiscal '24, we expect to meaningfully reduce equity burden relative to fiscal '23. And this will benefit future SBC expense since it's a lagging indicator. In terms of what we can control, in Q2, we reduced equity usage by approximately 50% versus the year-ago period. Finally, let me spend a moment on capital allocation.

We ended Q2 with over $2.4 billion of cash, cash equivalents, and short-term investments. We've elected to redeem the 2023 convertible notes in cash next month. But on a pro forma basis, we will continue to have significant liquidity. We will share more details of our capital allocation strategy at our investor and analyst day in January.

So, in closing, we remain intently focused on creating shareholder value by driving durable long-term growth and increasing our free cash flow and free cash flow margin. Despite a challenging macroeconomic environment, execution in Q2 was solid. We delivered strong results across the business, including exceeding our outlook on the top and bottom line. With that, let's open it up for questions.

Questions & Answers:


Operator

[Operator instructions] Your first question comes from the line of Matt Hedberg from RBC Capital Markets. Please go ahead. Your line is open.

Matt Hedberg -- RBC Capital Markets -- Analyst

Great, thanks for taking my question, guys. Gary and whole team, congrats on the results. Really, really good to see the momentum on both the top line and certainly the bottom line. It looks to me like you grew net new ARR really for the first time in a couple of years.

Obviously, great to see. You know, when you think about momentum into the second half and even next year, how do you expect to build on that success? And I guess, specifically, in outside of macros, which remain -- feels like it's stable here, what are the most important things that we should think about that could, perhaps, imply further acceleration as we look out into the second half into next year?

Gary Steele -- President and Chief Executive Officer

Yeah, great question, Matt. So, when we look at the business today, we continue to see tremendous strength in our security offerings. And people are modernizing their SOC or thinking differently about how they want to run their SOC, and we're playing an integral role there. New capabilities like attack analyze or things like that have been really well received by our customers and by prospects.

And then, more broadly, the advantage that we have bringing security and observability together, we're giving our customers this opportunity to standardize on single platform and save money in what has been a challenging economic time for folks. So, I think we're well positioned, what we saw in the quarter we think continues through the second half and into the coming year. And as we've described before, we're excited about growth opportunities outside the U.S., and you heard it in a lot of the prepared remarks with the customers that we closed. We're seeing very good traction in markets where we're relatively new.

And so, we feel like we have a lot of good momentum coming out of this quarter going into the second half, and we think it's a good setup as we contemplate next year.

Matt Hedberg -- RBC Capital Markets -- Analyst

Great to hear. Thanks a lot.

Operator

Your next question comes from the line of Brent Thill from Jefferies. Please go ahead. Your line is open.

Brent Thill -- Jefferies -- Analyst

Gary, can you characterize the demand environment, what you're seeing now versus, perhaps, six to nine months ago, if things started to improve, stabilize, or if they're stable, it's just better execution on your end? And a quick follow-up on Brian on expenses and where you're continuing to see the most leverage ahead in the operating margin expansion. Thanks.

Gary Steele -- President and Chief Executive Officer

Yeah. Hi, Brent. I think -- there's a couple of things. I think one is while we continue to see a high level of deal scrutiny, we see cloud migrations continue to be thoughtfully reviewed.

It's stabilized in the sense. I think we understand what that environment looks like. I think we're executing extremely well in this particular environment. I would say the macro environment is pretty much the same of what we see in the entire year as we mentioned in the prepared remarks.

But I think we're executing well within that.

Brian Roberts -- Chief Financial Officer

Yeah, Brent, and this is Brian. In terms of the expense question, I would say, look, we made very important progress in the first half of the year. And looking forward, we're going to continue evaluating opportunities to increase our efficiency and speed of execution. We should always be focused on identifying savings as we scale.

It's just what good businesses do. You know, as I shared in my prepared remarks, Q2 really was a milestone quarter as we reduced opex 3% while we grew ARR 16% year over year. And as we look forward, we're going to continue to see opportunities to drive leverage. So, we increased our free cash flow margin for the year as we plan to limit opex growth to just 2.5%.

And this is the second quarter in a row that we've increased our outlook for fiscal '24 free cash flow margin.

Katie White -- Director, Investor Relations

Great. Thanks --

Operator

Your next question comes from the line of Brad Zelnick from Deutsche Bank. Please go ahead. Your line is open.

Brad Zelnick -- Deutsche Bank -- Analyst

Great, thank you so much. Congrats, guys. Really, really great results. And it's great to see the cloud strength, you know, at the higher end of your expectations as a percentage of bookings.

But, Brian, your comments suggest you still face macro headwinds, and we should expect lumpiness from quarter to quarter, so not totally out of the woods yet. But can you expand on the cloud migration trends that you see? What type of customers are moving over? Which might be more resistive? And how if, in any way, are you adapting incentives to get customers over to paradise?

Brian Roberts -- Chief Financial Officer

Yes, I would say, first of all, at a high level, we were very pleased with Q2. Again, coming in at 64% of our software bookings in terms of the mix in terms of cloud. I would say from a cloud migration perspective, the trends that we've seen really since July of last year have remained relatively consistent. We haven't really seen much difference.

And so, I think it's important for folks to realize, again, cloud DBNRR is a trailing 12-month metric, but we, you know, do expect that that metric will stabilize in Q3 and Q4, probably about 400 basis points below where we are.

Gary Steele -- President and Chief Executive Officer

And, Brad, the one other thing I would add is the ROI on going to cloud continues to be extremely compelling. And so, I think we're telling that story well, and I think we're doing everything we can to ensure that customers understand that value. Because the reality is companies today, they want their teams getting great outcomes for Splunk, they don't want them managing Splunk. And so, this opportunity to getting people to the cloud allows teams to focus on those great outcomes.

And I think we're telling -- we're continuing to tell that story even better all the time. And I think that momentum is showing up in the numbers.

Brad Zelnick -- Deutsche Bank -- Analyst

Excellent, guys. Thanks for taking my question.

Operator

Your next question comes from the line of Raimo Lenschow from Barclays. Please go ahead. Your line is open.

Raimo Lenschow -- Barclays -- Analyst

Thank you. Two quick questions, and congrats from me as well. Gary, if you think like -- since you started, there has been a few changes in terms of how you sell in terms of more single-seller model, more outcome-based selling, kind of refocusing on a little bit more on security again. Like, where are we on that journey in terms of the whole sales organization kind of being -- kind of in there and seeing also the benefits as part of that? Is that part of what's going on here with the better results? And then, Brian, if you think about the cost takeout, like, there's -- obviously, the next question comes is like, well, you take our cost but you grow better.

That almost seems too good to be true. Like, in terms of what you're doing there, like, where are we on that journey of like taking stuff out that actually doesn't really support revenue and, hence, there's a lot more fat in the organization. Thank you.

Gary Steele -- President and Chief Executive Officer

Yeah, Raimo, so a couple of things. So, one is the move to single seller model that we did in October of last year has proven to be a really good outcome. I think it's better for our customers. I think it makes this more efficient.

And then aligning the resources to support those single sellers is something that we did relatively quickly. And so, I believe what you're seeing today in our numbers is the efficiency of that really playing out, and I think we're delivering very good outcomes to our customers as a result of it. So, I feel good about where we are in the evolution of that change and the impact that it's having with our customers. And I'll let Brian answer the rest of that.

Brian Roberts -- Chief Financial Officer

Sure. And I think in terms of our strategy, look, we're pretty consistent here. We want to increase efficiency and speed of execution. If you zoom out and look at the year, you know, we are increasing our investment in the sales and market -- sales and marketing and our go-to-market area to expand, especially in our international presence, improving some of our coverage ratios.

It really positions Splunk to win in new accounts. And then, on R&D, look, we're continuing to make R&D investments under new leadership. And I hope you got a sense from .conf that we've really accelerated our pace of innovation. We just -- we're becoming more efficient as we increase hiring in our global talent centers.

And if you look at the R&D trends, we had a cost action in Q1. But in Q2, R&D grew faster than any other expense category on a sequential basis, and we expect this trend to continue in Q3.

Raimo Lenschow -- Barclays -- Analyst

OK, perfect. Thank you. Congrats.

Brian Roberts -- Chief Financial Officer

Thank you.

Operator

Your next question comes from the line of Andrew Nowinski from Wells Fargo. Please go ahead. Your line is open.

Andy Nowinski -- Wells Fargo Securities -- Analyst

OK, thank you. Congrats on a great quarter. So, I wanted to ask about the partnership with Microsoft coming off your user conference that you announced. You mentioned the first win already was a boomerang customer.

I was wondering which vendor they replaced to come back to Splunk. And why did it take the partnership with Microsoft to convince them to come to Splunk? I guess I'm just trying to understand, you know, how applicable their thought process is to the rest of the customers and Azure that you might be able to flip?

Gary Steele -- President and Chief Executive Officer

Yeah, no, great question. I think what we've seen in the feedback we've gotten, the impetus for us to go drive that relationship with Microsoft was really driven by the customer feedback both Splunk and Microsoft were getting. And I think there's this -- because there's a lot of data that lives in Azure that people wanted to have Splunk natively available there. The real opportunity for us is to get to a native Splunk solution on Azure, which we believe we'll have within the next 18 months.

And that initial transaction that we saw, I don't have all the details actually of that. I think it's just the simple opportunity of someone wanting to be able to leverage their credits, having an experience in Splunk, and that momentum then carrying through to a very quick transaction. But I think there's very positive sentiment on the combination of Splunk and Azure.

Andy Nowinski -- Wells Fargo Securities -- Analyst

Great. Thanks, Gary.

Operator

Your next question comes from the line of Shrenik Kothari from Baird. Please go ahead. Your line is open. Shrenik, your line is open.

Your next question comes from the line of Keith Weiss from Morgan Stanley. Please go ahead. Your line is open.

Sanjit Singh -- Morgan Stanley -- Analyst

Thank you for taking the question. This Sanjit Singh in for Keith. Two quick ones for me. On the back of a lot of product announcements on the security side and on the observability side post the .conf conference here, is there any changes in sort of pricing and packaging and sort of go-to-market motion behind these capabilities as we look into the back half and into calendar '24?

Gary Steele -- President and Chief Executive Officer

There are no price changes. Obviously, these new capabilities represent additional add-on capabilities that customers can purchase. But the basic pricing structure, how we're going to market, we're basically taking these new capabilities and putting them through our existing structure.

Sanjit Singh -- Morgan Stanley -- Analyst

That makes sense. That makes complete sense. And then, just as the follow-up, you mentioned a number of unified security and observability wins in Q2. Who's actually making the purchasing decision? Is this being handled by the leadership of the SOC team, or this is being handled by more of the centralized platform or the operations team? Who is sort of leading the charge on making these architectural decisions?

Gary Steele -- President and Chief Executive Officer

Yeah, no, great question. And typically -- and then we could go through the details on a couple of these different customer wins that we talked about, typically, we've anchored in with the CISO. We have great acceptance broadly across the security team. And then, it spreads into broader IT.

And the observability sale, typically, then gets driven by a combination of CIOs, CTO. And under CTO, it's typically a head of operations. It's collectively across those folks. So, it's not -- a decision is not being made by security.

It is, basically, we're getting the endorsement and handoff from security, but it's getting made centrally in that CIO, CTO, head of operations area.

Sanjit Singh -- Morgan Stanley -- Analyst

That makes complete sense. Congrats on the return to the net new ARR positive growth.

Gary Steele -- President and Chief Executive Officer

Thanks.

Operator

Your next question comes from the line of Jacob Roberge from William Blair. Please go ahead. Your line is open.

Jake Roberge -- William Blair and Company -- Analyst

Hey, thanks for taking my questions, and congrats again on the great quarter. Helpful commentary on the lawsuit and what you're doing with your Edge Processor to maybe help combat some of those potential competitive threats. I'm curious what you've seen on the adoption front for that product from your existing base, just given it's free for cloud customers and kind of how they're parsing out the data distribution with that product.

Gary Steele -- President and Chief Executive Officer

Yeah, no, great question. It's relatively early. People are excited because they like the idea of not having to pay yet another license fee for something sitting around Splunk. And so, I would say the reception has been very positive, but I would also say it's early.

Jake Roberge -- William Blair and Company -- Analyst

Helpful. Thanks for taking my questions.

Operator

Your next question comes from the line of Rob Owens from Piper Sandler. Please go ahead. Your line is open.

Rob Owens -- Piper Sandler -- Analyst

Yeah, thanks for taking my question. I want to build on the unified security and observability questions from earlier and maybe understand just where you are in terms of that process. Realizing it's early, but any metrics you can share in terms of security customers versus observability customers? I think, more importantly, where you've landed with both, or cross-sell both -- cross-sold both, excuse me. What's this doing to deal size? And how do the new AI capabilities potentially accelerate this, if at all? Thanks.

Gary Steele -- President and Chief Executive Officer

Yeah, no, great question, Rob. So, the motion that we're running today is we're going to existing security customers where we have a strong anchor, strong set of relationships. We're using those relationships then to get to the broader central IT organization, either a CTO, CIO, sometimes vice president of operations. And we're showing them the value and opportunity of thinking about tool consolidation typically.

And literally, every customer that I talked to, they have tens of "monitoring tools." Using old words, but that's what they oftentimes have. And they're trying to figure out in this world where the digital footprint is growing rapidly how do they get a single architecture that enables them to scale that broad digital footprint. And so, you can't have a million different tools all doing different things. And so we run a broad play that enables us to show the value of Splunk and the value that you get by bringing the observability cloud in integrated with the core platform and how you can derive better resilience as a result of that.

So, that's the play we've been running and we enter -- we start with the base of security and we move to observability versus the other way around. And I'll let Brian comment, we don't -- we haven't published any great metrics. There may be some other ways to think about it, but --

Brian Roberts -- Chief Financial Officer

Yeah, I mean we look at the attached. I think we feel good about the momentum there. But back to Gary's point, when we can successfully sell unified security and observability, it helps, obviously, increase ARR. And it just makes that relationship even more sticky.

And I think one thing that we saw in Q2, you know, our renewal rate increased year over year, which we feel great about.

Rob Owens -- Piper Sandler -- Analyst

All right, thanks.

Operator

Your next question comes from the line of Joshua Tilton from Wolfe Research. Please go ahead. Your line is open.

Unknown speaker

Hey, this is Patrick on for Josh. Thanks for taking my question. You all talked pretty extensively about your own directives to drive cost efficiencies, and we've obviously heard a lot about optimizations across the industry. From your perspective, have you seen customers looking to optimize their spend with Splunk, whether it be with log ingestion or on the observability side? And then, also, on the observability side, do you find that you're replacing other vendors more often or homegrown solutions? Or is it kind of a mix of both? Thanks.

Gary Steele -- President and Chief Executive Officer

Yeah, I think in this economic time, I think customers broadly are looking at how they can overall optimize costs. So, I think that that is definitely a conversation. A few things to note. One is when customers say, "Hey, I feel like my Splunk bill is big, what can you do to help me?" We really talked through our overall strategy, which is, how do you think about your data and where it lives? So, through our federated search capabilities, we allow people to get access to data wherever it might live.

So, you can then think strategically about where's the lowest cost place for storage. Good example of that is S3, where we support federated search onto S3. And then, coupled with that, Edge Processor, one of the core capabilities of that solution is to reduce the level of data. So, we go -- we lean into those conversations and really help our customers think through where they can optimize and save money.

And then, as you extend that broadly into observability, as I mentioned before, thematically, we see lots of tool consolidation kinds of opportunities where the outcome is reduced spend of vendors, and we're leveraging the Splunk platform to be able to drive that dialog and win that. And then, in terms of your question on who the incumbents are, you basically see everybody as we go into these because big companies, I think -- Global 2000, again, they have a broad range of what they would term as monitoring solutions. So, you literally see everybody.

Katie White -- Director, Investor Relations

Great. Thanks --

Operator

Your next question comes from the line of Brad Sills from Bank of America. Please go ahead. Your line is open.

Brad Sills -- Bank of America Merrill Lynch -- Analyst

Oh, wonderful. Thanks for taking my question, and great to hear the commentary on interest level in observability. We certainly heard that from the channel. Would you classify that more as pipeline or, you know, deal activity that's already happening today? And, you know, if it is more pipeline, is there something on the horizon here in the roadmap that could potentially be a catalyst to convert that pipeline? Or is this just gradual effort to continue to integrate observability with the core security suite?

Gary Steele -- President and Chief Executive Officer

Yeah, no, great question, Brad. So, what I would say is, just going back to our prepared remarks, we had some amazing wins with our observability solution in the current period. At the same time, because of the broad interest level, pipeline continues to grow as well. And so, I would say, it's a little bit of both.

Like we've had really good adoption, and we're getting good reception. This play of doing tool consolidation has been working well. I think that's what's driving pipeline conversion in the short term. And then, we're on a long journey to continue to deliver new, cool capabilities that make the observability experience that much better.

And so, I don't know that there's any one thing that anybody's waiting for, Brad. I feel like the maturity of where we are today versus a year ago is amazing. And I feel like we've got a really good setup as we head into the second half and into next year.

Brad Sills -- Bank of America Merrill Lynch -- Analyst

Great to hear, Gary. One more, if I may, please. If you could just remind us, you know, how the macro has impacted the business. Are you talking about elongated sales cycles, you know, smaller deal sizes to get deals through? And coming out of the macro, could we potentially see some acceleration as those things come back?

Gary Steele -- President and Chief Executive Officer

Yeah, so I would say the macro environment has been largely consistent this entire year. And what that means to us has been we've seen choppiness in cloud migrations, meaning customers hem and haw over cloud migrations, they will defer them if they can because it represents an incremental project. There continues to be a lot of scrutiny, meaning additional sign-offs, etc. I think, though, having said all that, as we described earlier, I think our team has done a really good job of navigating through that.

And so, I think we've been able to deal with it reasonably well.

Brian Roberts -- Chief Financial Officer

Yeah. And think in terms of when you think of the second half of the year, there's no one out there thinking the macro environment is going to get better. And so I think we have to keep that in mind in terms of how budgets are set for calendar '24. So, we're not going to provide guidance today for next year, but stay tuned for investor and analyst day on January 9th.

Brad Sills -- Bank of America Merrill Lynch -- Analyst

Wonderful, thanks so much.

Operator

Your next question comes from the line of Pinjalim Bora from JPMorgan. Please go ahead. Your line is open.

Pinjalim Bora -- JPMorgan Chase and Company -- Analyst

Oh, great, thanks to squeezing me in, and congrats on the quarter. I just wanted to ask you about the renewals portfolio overall, maybe talk about the performance. I think you said renewals rate improved year over year. Was that for the whole portfolio or just cloud only? And any comments on kind of sequential improvement in renewal rates?

Brian Roberts -- Chief Financial Officer

Sure. So, that renewal is dollar-based, and it's the full portfolio, so it's all. And it did increase year over year. So, again, we're feeling really good in terms of the value proposition.

And it's just, back to Gary's point, how we're executing in this macro environment. And this is a year where, you know, renewals should grow in terms of the opportunity roughly 20% this year.

Pinjalim Bora -- JPMorgan Chase and Company -- Analyst

Understood. Thank you.

Operator

Your next question comes from the line of Keith Bachman from BMO. Please go ahead. Your line is open.

Keith Bachman -- BMO Capital Markets -- Analyst

Hi, many thanks. Gary and Brian, I wanted to ask about some of the drivers of growth and what specifically want to zero in on net new logos -- or net new customers I should say. And so we have the metrics for large customers, but I was wondering if you could just -- if you could speak to the breadth of customers. Are net new -- you know, are the net new logos or new customers entirely growing? Because it seems like if I just take your cloud DBNRR, which isn't reflective of total ARR, but if cloud DBNRR is in the mid-teens and you're guiding to total ARR growing and kind of in that same rate, you know, if you could just speak to the customer breadth underneath the largest customers.

And the corollary question is if you could speak a little bit to the competitive environment because -- you know, are you seeing more competition, say, at some of the smaller customers, whether it be Microsoft or anybody else that you want to call out? That's it for me. Thank you.

Brian Roberts -- Chief Financial Officer

Yeah, I'm happy, I'll take the new customer, and then I'll pivot back to Gary to cover the competitive environment. I would say, I think it's important when you're looking at DBNRR for us, remember it's a trailing 12-month base -- 12-month metric. So, it's literally the weighted average of the prior 12 months. You know, the way we look at it, new customers continue to drive growth.

From an ARR perspective, new customers generally account for roughly 20% of net new ARR in a trailing 12-month basis. And we were pleased that in Q2, this metric increased year over year. I'll let Gary talk to the environment.

Keith Bachman -- BMO Capital Markets -- Analyst

All right.

Gary Steele -- President and Chief Executive Officer

Yeah, on the competitive side, I would say the competitive environment was largely consistent with what we've seen this year. The players that we see in the observability market have remained consistent. And then, on the security side, I would say consistent as well. And even as you go to new customers, you will see incumbents there.

You might see some legacy SIEM vendors that we then take out and replace. That's been pretty consistent. So, I would say, there's no -- there's been no big fundamental change competitively.

Keith Bachman -- BMO Capital Markets -- Analyst

OK, great. Thanks.

Operator

Your final question comes from the line of Trevor Walsh from JMP Securities. Please go ahead. Your line is open.

Trevor Walsh -- JMP Securities -- Analyst

Great, good afternoon all. Thanks for taking my question. Gary, maybe for you, you mentioned the new regulations around public companies and reporting of incidents. I imagine Splunk is kind of on the tip of the spear of that being a SIEM and kind of the collector of all the information and alerts coming in.

How much risk is there with -- within that process, you're probably only going to be as good as the data coming in. So, how much risk is there around the other tools within the security stack, whether it's endpoint, network, etc., being either not properly tuned or maybe not quite best of breed and that that kind of maybe poor or less high fidelity data getting pumped in and Splunk kind of bears the burden of kind of dealing with all of that and maybe, you know, the reporting process kind of being maybe not as good as it could be from that perspective, just given that you're kind of, again, the tip of the spear, the clearinghouse of all the data kind of coming in?

Gary Steele -- President and Chief Executive Officer

Yeah, Trevor, really good question. So, I think if you just step back, I think the one thing that we're very positive about is this new FCC ruling really drives organizations to think through what is their strategy if there's an event and how quickly can they actually understand and then provide broad FCC -- the FCC broad viewpoint on where they stand. So, I think that's the No. 1 thing.

And one of the things we're getting very good at is helping customers mature their security environment. So, to your point, everyone's mileage varies in how mature they are. I think one of the kind of a key really interesting and exciting opportunities for us is we're very much focused on helping our customers drive that maturity journey to get the most value out of Splunk. And through that, they get the visibility they need to make those determinations because there's lots of places where, as you described, you could have lack of visibility because you didn't get the right data in or you didn't get the right alerts.

We have a very prescriptive program that we're driving with our customers to ensure that they're getting themselves set up correctly and helping them through that journey. And that's a very important motion. We've even accelerated that motion given, this new FCC ruling. That was something we had in place prior, but we're accelerating that.

Trevor Walsh -- JMP Securities -- Analyst

Great, that's super helpful. Thanks, Gary.

Operator

And we have no further questions at this time. Gary, I'll turn the call back over to you.

Gary Steele -- President and Chief Executive Officer

Great, thank you. I just want to take a moment to thank everyone for joining us on the call today. We look forward to seeing you out on the road. We'll be doing a lot of investor relations work over the coming quarter, and looking forward to seeing you soon.

Operator

This concludes today's conference call. [Operator signoff]

Duration: 0 minutes

Call participants:

Katie White -- Director, Investor Relations

Gary Steele -- President and Chief Executive Officer

Brian Roberts -- Chief Financial Officer

Matt Hedberg -- RBC Capital Markets -- Analyst

Brent Thill -- Jefferies -- Analyst

Brad Zelnick -- Deutsche Bank -- Analyst

Raimo Lenschow -- Barclays -- Analyst

Andy Nowinski -- Wells Fargo Securities -- Analyst

Sanjit Singh -- Morgan Stanley -- Analyst

Jake Roberge -- William Blair and Company -- Analyst

Rob Owens -- Piper Sandler -- Analyst

Unknown speaker

Brad Sills -- Bank of America Merrill Lynch -- Analyst

Pinjalim Bora -- JPMorgan Chase and Company -- Analyst

Keith Bachman -- BMO Capital Markets -- Analyst

Trevor Walsh -- JMP Securities -- Analyst

More SPLK analysis

All earnings call transcripts