In an era of software mega-deals, old network infrastructure giant Cisco Systems (CSCO -0.50%) apparently doesn't want to be left out. It just announced it intends to acquire Splunk (SPLK), which specializes in data log analysis and cloud observability software, for $28 billion in cash.

That isn't exactly chump change. If the deal is approved, it will instantly shoot into the top-five largest software acquisitions ever. 

  • Broadcom is waiting for final approval to purchase VMware for about $70 billion.
  • Dell acquired EMC for $67 billion in 2016. 
  • IBM bought Red Hat for $34 billion in 2019.  
  • The Cisco-Splunk deal for $28 billion.
  • Salesforce added Slack for just shy of $28 billion in 2021.

It's big money, but Cisco is good for it. Getting its hands on Splunk will also cement the company's ongoing transformation away from a hardware-centric business into more of a recurring-subscription software one. Is it now time to buy Cisco stock? 

Cisco empties its deep pockets

Splunk is itself a legacy business. It was a pioneer of analytics with its log management software pre-dating the cloud era, but numerous cloud-native peers (like Datadog and my personal fave, Dynatrace) have popped up in recent years with technology stacks and pricing better suited to modern needs. Splunk has been in a transition period to get itself up to speed with the times.

Its work has been paying off, though, and early signs were emerging that the heavy lifting was in the rearview mirror for Splunk. By some metrics, the stock could be viewed as cheap, especially when looking at the free-cash-flow generation of over $800 million over the last reported 12-month stretch. Net income under generally accepted accounting principles (GAAP) is also nearly back to breakeven.  

It's this size and potentially big-profit scale that likely led Cisco to the acquisition gods' altar, but the sacrifice demanded will be sizable: $28 billion in cash ($157 for each share of Splunk) is a hefty premium of 35 times trailing-12-month free cash flow, although Splunk's rapid progress on profit could lighten the sticker shock.

Cisco also can afford it. Management reported having over $26 billion in cash and short-term investments, and just $8.4 billion in debt, at the end of July.

Cisco's rationale

As I wrote about a few weeks ago, Cisco has been slowly making a transition from its traditional network-infrastructure prowess (selling more than $34 billion in network and internet hardware in fiscal 2023, 60% of its total sales) by peppering in more software subscriptions.

Numerous small tuck-in acquisitions have been key, and Cisco has done a bang-up job. It's been enjoying an acceleration in growth (22% last year, in part from a data-center upgrade cycle) all the while sustaining high levels of profitability.

CSCO Revenue (TTM) Chart

Data by YCharts. TTM = trailing 12mnths.

Splunk will immediately catapult Cisco's cybersecurity unit into high gear, as the former's data logs and observability software have morphed into a type of security service in recent years. If the merger were to take place today, Cisco would nearly double its $3.9 billion in trailing-12-month security sales with Splunk's $3.8 billion, making it one of the largest cybersecurity software businesses.

But does all of this make Cisco stock a buy? Maybe. Bear in mind Splunk is a sizable purchase, and that $28 billion price tag will weigh on Cisco net income (since amortization expense related to part of the acquisition will be realized over time).

Also, Splunk currently reports no GAAP net income, at least not just yet, and its free-cash-flow margins are slimmer than Cisco's. The market might want to take some time to digest the full implications of this deal once it goes through because it will cause some of Cisco's own margins to drop.

Given the size of it, I would expect a Cisco-Splunk tie-up to take about a year's time as it makes its regulatory-review rounds.

Cisco's growth rate is poised to decelerate to just a single-digit percentage in fiscal 2024 (the 12 months that end next July), and the impending cash outflow from Splunk (let's say that happens by the end of calendar year 2024) will no doubt weigh a bit on investor sentiment, too.

In the meantime, I think it could pay to be patient. Cisco is completing its transformation as a hardware and software company, which I like. But I'm not buying. I'll be watching how this drama unfolds very closely, though.