Splunk Inc. (SPLK) Q2 2024 Earnings Call Transcript

Splunk Inc. (NASDAQ:SPLK) Q2 2024 Earnings Conference Call August 23, 2023 4:30 PM ET

Company Participants

Katie White - Director, IR

Gary Steele - President and CEO

Brian Roberts - CFO

Conference Call Participants

Matt Hedberg - RBC Capital Markets

Brent Thill - Jefferies

Brad Zelnick - Deutsche Bank

Raimo Lenschow - Barclays

Andrew Nowinski - Wells Fargo

Sanjit Singh - Morgan Stanley

Jacob Roberge - William Blair

Rob Owens - Piper Sandler

Bradley Sills - Bank of America

Pinjalim Bora - JPMorgan

Keith Bachman - BMO Capital Markets

Trevor Walsh - JMP Securities

Operator

Good afternoon. My name is Krista, and I'll be your conference operator today. At this time, I would like to welcome everyone to the Splunk Second Quarter 2024 Financial Results Conference Call. [Operator Instructions] Thank you.

I will now turn the call over to Katie White, Director of Investor Relations. Please go ahead.

Katie White

Thank you, Krista. Good afternoon, and thank you for joining today's call. With me on the call are Gary Steele, President and CEO; and Brian Roberts, CFO.

After market closed today, we issued our earnings press release, which is also posted on our Investor Relations website along with supplemental material. This conference call is being webcast live, and following the call, an audio replay will be available on our website.

On today's call, we will be making forward-looking statements, including financial guidance and expectations, including our growth and profitability, forecast for our third quarter and full year fiscal 2024. And our future expectations of revenue, total ARR, cloud mix, non-GAAP operating expenses, non-GAAP operating margin, free cash flow, free cash flow margin, Cloud DBNRR, cloud gross margin, equity compensation usage and liquidity, as well as trends in our markets and our business, our strategies and expectations regarding our business, AI, acquisitions, products, technology, customers, demand and regulatory environments. These statements are subject to risks and uncertainties and are based on actions as to the macroeconomic environment and reflect our best judgment based on factors currently known to us. Actual events or results may differ materially. Please refer to documents we file with the SEC, including our Form 10-K and 10-Qs as well as the Form 8-K filed with today's press release. These documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.

So with that, let me turn it over to Gary.

Gary Steele

Good afternoon, and thank you for joining today's call. To start, Splunk delivered a solid second quarter. Through our ongoing focus on execution, operational discipline and customer engagement, we met or exceeded each of our guided metrics in Q2. I'm really pleased with these results and want to thank the entire Splunk team for their hard work and commitment. At the same time, we further accelerated Splunk's innovate to help our customers achieve resilience across their digital systems through a series of important and exciting announcements. I'll cover our financial results first.

Since joining Splunk 16 months ago, we've been executing to drive long-term durable growth with increasing profitability. Our Q2 results yet again showcase our ability to deliver on that strategy, particularly through ARR and free cash flow growth, which we believe are the best top and bottom line metrics of the health and strength of our business. In Q2, we grew total ARR to $3.858 billion, a 16% year-over-year increase, exceeding the guidance we shared on our last earnings call by over $30 million.

Cloud ARR increased 27% year-over-year to $1.918 billion. And our Q2 total revenue grew to $911 million, a 14% year-over-year increase well above our previously guided range. We delivered our top line growth while maintaining a sharp focus on operating efficiency and controlling costs. In fact, that focus enabled us to reduce non-GAAP OpEx by 3% year-over-year, which is significant, given that we previously anticipated an increase of between 2% and 2.5%. What's more? We exceeded expectations for free cash flow in Q2, delivering positive $4 million, nearly $20 million above our guidance. Given our considerable progress on driving more efficient growth, we are increasing our full year outlook for free cash flow. Brian will share our updated guidance shortly.

We're proud of what we delivered this quarter even as the uncertain macro environment remain largely consistent with what we've seen throughout this year. Our Q2 performance clearly demonstrates that we have dialed in our ability to navigate the current landscape and execute with consistency to deliver durable growth and profitability. What's also evident is that organizations around the world need Splunk's world-class unified security and observability platform more than ever to underpin the resilience of their digital systems.

Since becoming CEO, one of my top priorities has been to increase the pace of our innovation. As the technology landscape evolves and becomes more complex, organizations need to see and understand what's happening in their environments in order to keep their systems safe and reliable. In the simplest sense, if you can't see it, you can't secure it, you can't keep it up and running either. I hear time and again from CISOs, CIOs and CTOs that Splunk's commitment to providing comprehensive visibility into and across environments is critical in today's hybrid multi-cloud world. I'll spend the next few minutes sharing how we're deepening that commitment by taking you through what we announced in July at Splunk's annual user conference .conf23.

During our last earnings call, I spoke about our enthusiasm that AI would fundamentally transform the way organizations keep their digital systems secure and reliable. Given Splunk's flexible and highly scalable data architecture, our industry-leading security and observability solutions and our quickening pace of innovation, we are in a unique position to help enterprises bolster resilience by harnessing AI across our product portfolio.

During .conf23, we unveiled the next step in how Splunk is bringing AI to bear across security and observability. Splunk AI is a collection of new and existing AI-powered offerings that combines automation with human-in-the-loop experiences, so organizations can drive faster detection, investigation and response while controlling how AI is applied to their data. By optimizing domain-specific large language models and machine learning algorithms built on security and observability data, Splunk AI frees up security, IT and engineering teams for more strategic work helping to increase productivity and lower costs. In addition, we're applying AI to help teams accelerate time to value through assisted intelligence.

Our new Splunk AI assistant leverages generative AI to provide an immersive chat experience and helps make our search processing language or SPL easier to use by enabling the use of natural language to create SPL queries. We're excited that Splunk AI will continue building on our track record of innovation in AI and ML. This includes our recently launched app for anomaly detection that uses ML and our widely used machine learning toolkit. Looking forward, we see broad opportunities to further apply AI to make our core platform and premium products that much more powerful through advanced functionality. At .conf, we also introduced many new products and features that empower security, IT and engineering teams with unified experiences and workflows so they can detect investigate and respond to threats quickly, early and at scale.

In security, we announced multiple new features for our award-winning enterprise security and store products, and we also announced the general availability of Splunk Attack Analyzer, which integrates the capabilities we acquired from Twin Wave last year into our unified security operations experience. Splunk Attack Analyzer is already being used by some of the world's largest companies to analyze threats, including those that employees reported as suspected phishing e-mails. Through an integration with Splunk SOAR, customers that are using Splunk Attack Analyzer and SOAR can fully automate threat analysis process to ensure accurate and timely detections while reducing the time and resources typically spent doing manual investigations.

We also shared our continued delivery on our unified security operations center vision, which aligns to the threat detection, investigation and response or TDIR framework. The cornerstone of our approach is Splunk Mission Control, which brings together security analytics, automation and orchestration and threat intelligence capabilities under one common work service, empowering security teams to stay ahead of cyber threats. By unifying, simplifying and modernizing how Splunk is used in the sock, we're helping teams overcome the challenge of having too many disparate tools, too little time and nonstop threats and alerts coming across their console.

On the durability side, we were named a leader in the 2023 Gartner Magic Quadrant for application performance monitoring and observability. This recognition builds on our nine consecutive times of being named a leader in the 2022 Gartner Magic Quadrant for Security Information and Event Management. Today, Splunk is the only vendor to be named a leader in both of the Gartner Magic Quadrants.

Our goal is to create a single unified experience for security, IT and engineering teams across security and observability. To that end, we continue to unify Splunk Observability Cloud with the Splunk platform. 2022, we launched Splunk Log Observer Connect, enabling Observability Cloud users to seamlessly use their Splunk Enterprise and Splunk Cloud platform data. We didn't stop there. In Q2, we previewed the OpenTelemetry Collector as a technical add-on, which provides customers a unified view of their infrastructure and services. We also launched unified identity to give our customers a better user experience as they access data from the Splunk Cloud platform and Splunk Observability Cloud without the need to authenticate multiple times. Looking ahead, we're continuing to invest in the enterprise-grade observability solutions organizations need to monitor and troubleshoot across the entire tech stack.

A guiding factor in our innovation is a belief that organization shouldn't be locked into one environment and should have choice in how they architect their systems across the multi-cloud hybrid mold. We're continuing to find ways to make sure that Splunk is available natively to customers in the cloud environment that work best for them. That's why one of the most exciting announced ads.com was our new strategic partnership with Microsoft to build Splunk's cloud solutions natively on Microsoft Azure. Together, our approach will enable our joint customers to migrate, modernize and grow their environments with end-to-end cloud and hybrid visibility at scale.

In addition, organizations globally can now purchase Splunk Enterprise, Splunk Enterprise Security and Splunk IT Service Intelligence in the Azure Marketplace. We're powering thousands of our joint customers with best-in-class solutions, and I'm glad to share that the first transaction closed in Q2 was a boomerang customer returning to Splunk, thanks to the flexibility and value our approach provides.

Another area where we're continuing to invest is in driving innovation at the Edge. Given the explosion of data, processing information on the Edge has become a critical priority, both for Splunk and our customers. Last quarter, we launched Splunk Edge Processor, which helps our customers process data at the Edge to increase visibility and control over their data before it leaves their network and helps ensure that it ends up at the right destination in the right format. We know this is an essential capability and we are proud to offer Edge processor for free to our Splunk Cloud customers. As Edge processor is adopted by our customer base, we believe it will significantly reduce the need for customers to leverage external vendors to preprocess their data.

Related to this, a few of you have asked us about our ongoing lawsuit against Cribl. Although my ability to comment on active litigation is limited, I can tell you that the litigation is very active and the case is scheduled to go to trial in April of 2024. You may recall that this case is about Cribl taking and illegally using our intellectual property. And indeed, Cribl has conceded that it reverse engineered features in Splunk Software. Our case is strong, and we look forward to continuing to prove it.

Shifting back to our Edge innovation. Another exciting announcement during the quarter was Splunk Edge Hub, which provides more complete visibility across IT and OT environments by streaming previously hard to access data directly into the Splunk platform. For manufacturers, factory floors, server rooms and more Edge have simplified the ingestion and analysis of data generated by sensors, IoT devices and industrial equipment, enabling advanced monitoring, investigation and response. Edge Hub is sold exclusively through our go-to-market partners who bring deep industry expertise on our customers' IT environment. And I'm pleased to share we're seeing compelling customer use cases from early adopters. For example, a multinational manufacturing company uses Edge Hub to interface with their production systems to collect machine data to classify defects.

With over 1 million annual consumer device production capacity, this organization is continuously looking for incremental quality improvement opportunities to save costs and assess factory expansion needs for increases in customer demand. After deploying Edge Hub, the organization achieved a reduction of approximately 70% in defective parts during their QA process, resulted in more than 20% labor cost savings associated with otherwise scrapped or rework products. We're excited to have once again broken down a barrier for our customers to gain more visibility into their data, and we're looking forward to building on Edge Hub's early success.

Let's change gears and highlight the continued demand we're seeing from customers around the world. We ended Q2 with 834 customers with $1 million or more in ARR, up by 24 since just last quarter. This includes 452 customers with Cloud ARR over $1 million, which is up by 100 year-over-year from the 352 cloud customers with ARR over $1 million in the year ago period. Our team landed many significant deals in Q2 that illustrate our growth levers and the breadth of value we bring to the largest and most complex global enterprises.

I'll start with observability. Since 2018, we built, acquired and integrated what we believe are the best technologies to help enterprises monitor, operate and improve their hybrid technology environments. Our rapid innovation and investments in observability are paying off for Splunk and our customers. We're continuing to win significant deals and displace leading competitors by offering customers comprehensive observability solutions in a unified experience. During Q2, we were pleased to secure a 7-figure observability deal and extend our footprint within a leading U.S. financial services organization. This customer needs to close the visibility gaps and requires a complete hybrid platform solution that eases resource constraints and consolidate their observability tools and cost as they prepare to move more than 150 applications to the cloud.

We were already the trusted security provider, and through a technical proof of concept, we demonstrated not only the observability features needed for their transformation and full visibility, but also the vital platform integration capability to complement their existing use of Splunk and help them avoid tools fraud, data silos and waste.

In Q2, a U.S.-based multinational conglomerate and long-standing hybrid security customer significantly expanded their use of Splunk by shifting more of their workload to cloud and through a new 7-figure 3-year observability deal for the new health care division and cloud stack. They chose Splunk observability over competitive options because of our ability to drive lower total cost of ownership and because our differentiated capabilities offer full visibility by using not only metrics and traces, but also underlying logs, helping enhance resilience by proactively preventing outages while also monitoring critical infrastructure and applications. The market for observability is growing rapidly, and only Splunk has the integrated enterprise-grade solutions needed by the IT and engineering team of the Global 2000 to keep their services up and running.

Now turning to security. Since joining Splunk, I've led the team to deliver better outcomes and more value to our customer security leaders by making the work of their security team that much more effective and efficient. During the quarter, we continued to see strong demand for our industry-leading SIEM and premium security solutions needed in the modern SaaS. In Q2, we secured a significant cloud deal with a global leader in transport and logistics. Following a competitive selection process, this Europe-based organization chose Splunk to support and consolidate its complex security needs on a global level. This 7-figure Splunk Cloud and Splunk Enterprise Security deal displaced a legacy SIEM competitor and as a result of our growing strategic partnership to help them drive resilience through our single unified platform.

We also secured a new logo win during Q2 in Europe for Splunk Cloud and Splunk Enterprise Security with a global automotive technology company. The customer chose Splunk over competitors due to limitations in their legacy SIEM and because of our ability to provide full visibility across all of its data sources from over 150 sites globally. The organization is expanding rapidly in software development; and with 200,000 employees, now count on Splunk to keep their system safe and reliable as they scale.

Our public sector momentum also continued in the quarter with an 8-figure security expansion and renewal with a large U.S. federal agency that is all in on Splunk. They have centralized their modernization and cybersecurity operations strategy around Splunk and are also delving into both AIOps and ITOps with us. As of Q2, they ingest 30x more data per day than they did in 2019, leveraging hundreds of SIEM use cases as well as several of our premium applications, including nearly 50 store automation playbooks.

Our work with government agencies is incredibly important, and we're proud of our partnership with this agency to advance their security operations to keep public information safe from threat actors while ensuring a world-class user experience across several applications. Looking ahead at security, we fundamentally believe that Splunk will continue to play a critical role in helping organizations navigate the evolving cybersecurity landscape.

One important example where our innovation and security leadership will be essential, it's helping our U.S. public company customers comply with the SEC's recently announced rules on cybersecurity incident disclosure that will be effective later this year with a 4 business-day window to report once the cybersecurity incident is de material, timely response is essential. Splunk's strength is detection and response and the investigative capabilities we provide can help customers quickly gather and analyze telemetry from various tools and sources to classify an event and determine if it's material and requires SEC reporting. Our ability to see across the vast quantities of data helps organizations quickly understand not only if something happened, but also how it happened.

We believe our security solutions will be even more critical as organizations invest in broader resilience strategies to mitigate future cyber threats and improved visibility into their IT infrastructure and accelerated detection and response. This is yet another dimension of value we bring as a strategic partner to our customers' executives as the cybersecurity landscape evolves.

Finally, our customers can continue to tell us there's incredible value when they utilize both security and observability to solve their complex visibility challenges. During the quarter, we deepened our strategic partnerships with many organizations on their path to greater resilience through unified security and observability. We secured a 7-figure security and observability deal in Q2 with a multinational banking and financial services company headquartered in the Asia Pacific region. This milestone renewal and expansion deal took place in a highly competitive landscape, and it represents the deep level of engagement in our partnership over several years. We previously transitioned this organization from on-prem to the cloud, and now our momentum continues as they double down on our security and implements monk observability to meet their evolving needs.

To wrap up, I want to reflect on the journey Splunkers and I have been on for the past 16 months. When I joined Splunk, my thesis was that we could accelerate Splunk's 20 years of industry leadership to deliver even more exceptional customer and shareholder value. I since led the team to build more executive-level customer relationships. We are a vital strategic partner to customers worldwide and we are focused on serving their expanding needs by increasing the pace of innovation. Along the way, we have cultivated the leadership and talent needed to drive durable growth with increasing profitability. Our results demonstrate that my thesis is proving out, and that Splunk is the key to enterprise resilience. Thank you again for joining today's call.

Now over to Brian to walk through our financial results and outlook.

Brian Roberts

Thanks, Gary. So let's get to our financial review and outlook. We continue to successfully navigate this economic backdrop and close a solid quarter as we exceeded or met our outlook across all guided metrics. We increased total ARR by 16% year-over-year to $3.858 billion, above our prior outlook of 15% growth. Cloud ARR increased 27% year-over-year to $1.918 billion. Cloud DBNRR, which is a trailing 12-month metric, was 116%, which was in line with our expectations. Remember, cloud migrations began to slow in July of last year, which impacts this trailing 12-month metric.

In terms of mix, the cloud portion of Q2 software bookings came in at 64%, near the top end of our quarterly outlook of between 55% and 65%. Q2 total revenue increased 14% year-over-year to $911 million, ahead of our guidance range of between $880 million and $895 million. Cloud revenue increased by 29% year-over-year to $445 million.

With regards to cloud gross margin, we continue to make progress on our efficiency initiatives. Q2 non-GAAP cloud gross margin reached 73.8%, an all-time quarterly record, which is up nearly 450 basis points year-over-year and better than our outlook.

Now let's move to operating expenses. Q2 was a milestone quarter. It was a showcase of our strong collaborative execution. We asked teams to find new unlocks and they rose to the challenge. They identified new opportunities to reduce third-party spend as well as expand scope for team members, which helped us decrease cost and increase operating efficiency. As a result, we were able to reduce non-GAAP OpEx by 3% year-over-year instead of the previously expected increase of between 2% and 2.5%. And we achieved this while growing ARR by 16% year-over-year, ahead of our outlook.

The significant cost leveraging, combined with our revenue beat helped us exceed our guidance on non-GAAP operating margin. In Q2, we achieved a 16.7% non-GAAP operating margin, which was 470 basis points to 670 basis points above our guidance of between 10% and 12%.

Let's move to free cash flow. Remember, Q2 is seasonally impacted given it follows our typically slowest bookings quarter, which has historically led to negative quarterly free cash flow. In Q2, we exceeded expectations and generated $4 million of positive free cash flow, which is $19 million ahead of our guidance. Given the seasonality of bookings, we recommend that investors evaluate free cash flow on a trailing 12-month basis, which totaled $805 million at the end of Q2, nearly quadruple the $216 million generated over the 12 months ending July 31, 2022.

Before I move to guidance, I am pleased to announce that we will host our Investor and Analyst Day in New York City on January 9. We are excited to share our strategy, long-term targets and capital allocation plan with you. More details will follow as we approach the date.

And with that, let's turn to guidance. The current selling environment remains uncertain. We continue to experience increased scrutiny on deals as well as delayed cloud migrations. That said, we're pleased with our first half execution, navigating this macro backdrop. Based on our progress to date, we're increasing the low end of our ARR outlook to $4.15 billion. In terms of the high end, until we see a positive change in the macro environment, we believe it's prudent to hold it unchanged at $4.175 billion. Separately, we are increasing our annual revenue outlook to a range of between $3.925 billion and $3.95 billion, up from our prior single point estimate of $3.9 billion, an increase of $25 million to $50 million.

Please recognize that duration and mix of term contract volume could significantly impact reported revenue and associated growth rates. I want to remind investors that our software license revenue related to term contract volume is recognized upfront. Thus, GAAP revenue is highly subject to both bookings mix and contract duration. As a reminder, we believe ARR is a better top line indicator since we bill both cloud and term software license customers on an annual basis.

So let's move to expenses and the impact on free cash flow. We remain laser-focused on improving our margin profile. We made outstanding progress in the first half. And looking forward, we remain extremely focused on unlocking additional savings and efficiencies. As a result, we are updating our annual expense guidance as we now expect to manage annual non-GAAP OpEx growth below our prior outlook. At the beginning of this fiscal year, we provided an outlook for annual non-GAAP OpEx growth of 7%. Last quarter, based on Q1 progress, we changed our guidance to between 5% and 6% growth. And we now have a new outlook. We expect that we can hold non-GAAP OpEx growth in fiscal '24 to approximately 2.5%, which represents a 450 basis point improvement from our original outlook at the beginning of the year, and a 300 basis point improvement from the midpoint of our outlook provided just one quarter ago.

In terms of the impact on margins, we now expect a fiscal '24 non-GAAP operating margin of between 21% and 21.5%, up 300 basis points from our prior guidance range. Based on our successful expense management, we're also increasing our annual free cash flow forecast by an additional $50 million. We now expect to generate free cash flow between $855 million and $875 million in fiscal '24, which represents a year-over-year increase of between 100% and 105% from the $427 million generated in fiscal '23. As a percentage of ARR, this would represent a free cash flow margin between 20.6% and 21%, up from just 11.6% in fiscal '23.

Let's move to near-term guidance. In Q3, we expect to grow ARR by over $120 million to $3.98 billion, which represents 15% year-over-year growth.

With regards to bookings mix, it's important to note that the U.S. public sector has historically had an outsized impact on our business in Q3 given the federal fiscal year end of September 30 and typical purchasing patterns. The majority of our public sector business remains on-prem and the expected renewals and expansions in Q3 will impact the cloud mix of software bookings. So while we continue to expect the cloud mix of software bookings will range between 55% and 65% each quarter, we will likely be towards the bottom end in Q3 after reaching the top end in Q2. Trailing 12-month cloud DBNRR should tick down by approximately 400 basis points and roughly stabilizing that vicinity for the remainder of the year.

I am pleased to share that we now expect to achieve an important milestone early. We previously indicated that cloud services would represent the majority of total ARR in the second half of the year. We now expect to achieve this during Q3.

Let's move to revenue. We expect revenue between $1.02 billion and $1.035 billion in Q3, representing year-over-year growth of approximately 10% to 11%. With respect to non-GAAP cloud gross margin, we expect it will be relatively flat quarter-on-quarter as we focus on improving service levels and customer experience. This would still represent approximately a 100 basis point improvement year-over-year. We continue to expect that we can achieve non-GAAP cloud gross margins of roughly 74% in Q4. We expect Q3 non-GAAP OpEx growth to range between 4% and 5% year-over-year as we begin to comp some of the cost actions we took last year. This OpEx growth translates into an expected Q3 non-GAAP operating margin of between 24.7% and 25.3%.

Let's move to cash flow. In Q3, we expect to generate $75 million of free cash flow. This implies free cash flow of $834 million for the 12 months ending October 31, 2023, which is nearly triple the $287 million of free cash flow for the 12 months ending October 31, 2022. We then expect to generate approximately $300 million of free cash flow in Q4. Again, for the full year, we expect free cash flow of between $855 million and $875 million, which is an increase of $50 million compared to our guidance range provided last quarter.

Let's move to equity. As I mentioned last quarter, we're taking deliberate steps to reduce equity dilution. In fiscal '24, we expect to meaningfully reduce equity burn relative to fiscal '23, and this will benefit future SBC expense since it’s a lagging indicator. In terms of what we can control in Q2, we reduced equity usage by approximately 50% versus the year ago period.

Finally, let me spend a moment on capital allocation. We ended Q2 with over $2.4 billion of cash, cash equivalents and short-term investments. We have elected to redeem the 2023 convertible notes in cash next month. But on a pro forma basis, we will continue to have significant liquidity. We will share more details of our capital allocation strategy at our Investor and Analyst Day in January.

So in closing, we remain intently focused on creating shareholder value by driving durable long-term growth and increasing our free cash flow and free cash flow margin. Despite a challenging macroeconomic environment, execution in Q2 was solid. We delivered strong results across the business, including exceeding our outlook on the top and bottom line.

With that, let's open it up for questions.

Question-and-Answer Session

Operator

[Operator Instructions] Your first question comes from the line of Matt Hedberg from RBC Capital Markets.

Matt Hedberg

Gary and the whole team, congrats on the results. Really, really good to see the momentum on both the top line and certainly the bottom line. It looks to me like you grew net new ARR really for the first time in a couple of years. Obviously, great to see. When you think about momentum in the second half and even next year, how do you expect to build on this success? And I guess specifically, outside of macros, which remain -- it feels like it's stable here, what are the most important things that we should think about that could perhaps apply further acceleration as we look out into the second half into next year?

Gary Steele

Yes. Yes, great question, Matt. So when we look at the business today, we continue to see tremendous strength in our security offerings and people are modernizing their stocks. Thinking differently about how they want to run their stock, and we're playing an integral role there. New capabilities like Attack Analyzer things like that have been really well received by our customers and by prospects. And then more broadly, the advantage that we have, bringing security and observability together, we're giving our customers this opportunity to standardize on a single platform and save money in what has been a challenging economic time for folks.

So I think we're well positioned. What we saw in the quarter, we think, continues through the second half and into the coming year. And as we described before, we're excited about growth opportunities outside the U.S., and you heard it in a lot of the prepared remarks with the customers that we close, we're seeing very good traction in markets where we're relatively new. And so we feel like we have a lot of good momentum coming out of this quarter going into the second half, and we think it's a good setup as we contemplate next year.

Operator

Your next question comes from the line of Brent Thill from Jefferies.

Brent Thill

Gary, can you characterize the just demand environment, what you're seeing now versus perhaps six to nine months ago, if things started to improve, stabilize if they're stable, it's just better execution on your end? And I had a quick follow-up on Brian on expenses and where you're continuing to see the most leverage ahead in the operating margin expansion?

Gary Steele

Brent, I think there's a couple of things. I think one is, while we continue to see a high level of deal scrutiny, we see cloud migrations continue to be thoughtfully reviewed. It's stabilized in the sense, I think we understand what that environment looks like. I think we're executing extremely well in this particular environment. I would say the macro environment is pretty much the same as what we see in the entire year, as we mentioned in the prepared remarks, but I think we're well within that.

Brian Roberts

Yes, Brent, this is Brian. In terms of the expense question, I would say, look, we made very important progress in the first half of the year. And looking forward, we're going to continue evaluating opportunities to increase our efficiency and speed of execution. We should always be focused on identifying savings as we scale. It's just what good businesses do.

As I shared in my prepared remarks, Q2 really was a milestone quarter as we reduced OpEx 3% while we grew ARR 16% year-over-year. And as we look forward, we're going to continue to see opportunities to drive leverage. So we increased our free cash flow margin for the year as we plan to limit OpEx growth to just 2.5%, and this is the second quarter in a row that we've increased our outlook for fiscal '24 free cash flow margin.

Operator

Your next question comes from the line of Brad Zelnick from Deutsche Bank.

Brad Zelnick

Congrats, guys. Really great results. And it's great to see the cloud strength at the higher end of your expectations as a percentage of bookings. But Brian, your comments suggest you still face macro headwinds and we should expect lumpiness from quarter-to-quarter. So not totally out of the woods yet. But can you expand on the cloud migration trends that you see? What type of customers are moving over, which might be more resistive? And how if in any way are you adapting incentives to get customers over to paradise?

Brian Roberts

Yes. So I would say, first of all, at a high level, we were very pleased with Q2, again, coming in at 64% of our software bookings in terms of the mix, in terms of cloud. I would say, from a cloud migration perspective, the trends that we've seen really since July of last year have remained relatively consistent. We haven't really seen much difference. And so I think I think it's important for folks to realize again, cloud DBNRR is a trailing 12-month metric. But we do expect that, that metric will stabilize in Q3 and Q4, probably about 400 basis points below where we are.

Gary Steele

And Brad, one other thing I would add is the ROI on going to cloud continues to be extremely compelling. And so I think we're telling that story well and I think we're doing everything we can to ensure that customers understand that value. Because the reality is, companies today, they want their teams getting great outcomes for Splunk. They don't want them managing Splunk. And so this opportunity getting people to the cloud allows teams to focus on those great outcomes. And I think we're telling -- we continue to tell that story even better all the time. And I think that momentum is showing up in the numbers.

Operator

Your next question comes from the line of Raimo Lenschow from Barclays.

Raimo Lenschow

Two quick questions and congrats from me as well. Gary, if you think like since you started, there has been a few changes in terms of how you sell in terms of more a single seller model, more outcome-based selling, kind of refocusing on a little bit more on security again. Like where are we on that journey in terms of the whole sales organization kind of being kind of in there and seeing also the fit as part of that. Is that part of what's going on here with the better results? And then Brian, if you think about the cost takeout like there's obviously the next question comes, it's like, well, you take out cost, but you grow better, that almost seems too good to be true. Like in terms of what you're doing there, like where are we on that journey of like taking stuff out that actually doesn't really support revenue, and hence, there's a lot more fat in the organization.

Gary Steele

Yes. Raimo, so a couple of things. So one is the move to single seller model that we did in October of last year has proven to be a really good outcome. I think it's better for our customers. I think it makes us more efficient. And then aligning the resources to support those single sellers is something that we did relatively quickly. And so I believe what you're seeing today in our numbers is the efficiency of that really playing out. And I think we're delivering very good outcomes to our customers as a result of it. So I feel good about where we are in the evolution of that change and the impact that it's having with our customers. And I'll let Brian answer the rest of that.

Brian Roberts

Sure. And I think in terms of our strategy, look, we're pretty consistent here. We want to increase efficiency and speed of execution. If you zoom out and look at the year, we are increasing our investment in the sales and market -- sales and marketing in our go-to-market area to expand, especially in our international presence, improving some of our coverage ratios and really position Splunk to win in new accounts.

And then on R&D, look, we're continuing to make R&D investments under new leadership, and I hope you got a sense from .conf that we've really accelerated our pace of innovation. We just -- we're becoming more efficient as we increase hiring in our global talent centers. And if you look at the R&D trends, we had a cost action in Q1. But in Q2, R&D grew faster than any other expense category on a sequential basis, and we expect this trend to continue in Q3.

Operator

Your next question comes from the line of Andrew Nowinski from Wells Fargo.

Andrew Nowinski

Congrats on a great quarter. So I wanted to ask about the partnership with Microsoft coming off your user conference that you announced that. You mentioned the first win already was a boomerang customer. I was wondering which vendor they replaced to come back to Splunk. And why did it take the partnership with Microsoft to convince them to come to Splunk? I guess I'm just trying to understand how applicable their thought process is to the rest of the customers in Azure that you might be able to flip?

Gary Steele

Yes. No, great question. I think what we've seen in the feedback we've gotten, the impetus for us to go drive that relationship with Microsoft was really driven by the customer feedback, both Splunk and Microsoft. And I think there's this -- because there's a lot of data that lives in Azure that people wanted to have Splunk natively available there. The real opportunity for us is to get to native Splunk solution on Azure, which we believe will have within the next 18 months. And that initial transaction that we saw, I don't have all the details actually of that. I think it's just the simple opportunity as someone wanting to be able to leverage their credits, having an experience in Splunk and that momentum then carrying through to a very quick transaction. But I think there's a very positive sentiment on the combination of Splunk and Azure.

Operator

Your next question comes from the line of Shrenik Kothari from Baird. Your next question comes from the line of Keith Weiss from Morgan Stanley.

Sanjit Singh

This is an Sanjit in for Keith. Two quick ones from me. On the back of a lot of product announcements on the security side and on the observability side, post the .conf conference, is there any changes in sort of pricing and packaging and sort of go-to-market motion behind the capabilities as we look into the back half and into calendar '24?

Gary Steele

There are no price changes. Obviously, these new capabilities represent additional add-on capabilities that customers can purchase. But the basic pricing structure, how we're going to market we're basically taking these new capabilities and putting them through our existing structure.

Sanjit Singh

That makes sense. That makes complete sense. And then just as a follow-up. You mentioned a number of unified security and observability wins in Q2, who is actually making the purchasing decision? Is this being handled by the leadership of the Splunk team? Or this is the have buy more of the centralized platform or the operations team is sort of leading the charge on making these architectural decisions?

Gary Steele

Yes. No, great question. And typically, and then we could go through the details on a couple of these different customer wins that we talked about. Typically, we've anchored in with the CISO. We have great acceptance broadly across the security team, and then it spreads into broader IT and the observability sale typically then gets driven by a combination of CIO, CTO, and under CTO is typically ahead of operations. It's collectively across those folks. So it's not -- the decision is not being made by security. It is basically we're getting the endorsement and handoff from security, but it's getting made centrally in that CIO, CTO, Head of Operations area.

Operator

Your next question comes from the line of Jacob Roberge from William Blair.

Jacob Roberge

Congrats again on the great quarter. Helpful commentary on the Cribl lawsuit and what you're doing with your Edge processor to maybe help combat some of those potential competitive threats. I'm curious what you've seen on the adoption front for that product from your existing base, just given it's free for cloud customers and kind of how they're parsing out the data distribution with that product?

Gary Steele

Yes. No, great question. It's relatively early. People are excited because they like the idea of not having to pay yet another license fee for something sitting around Splunk. And so I would say the reception has been very positive, but I would also say it's early.

Operator

Your next question comes from the line of Rob Owens from Piper Sandler.

Rob Owens

Build on the unified security and observability questions from earlier. Maybe understand just where you are in terms of that process. Realizing it's early, but any metrics you can share in terms of security customers versus observability customers. I think more importantly, where you've landed with both the cross-sold both, excuse me, what's this doing to deal size? And how do the new AI capabilities potentially accelerate this, if at all?

Gary Steele

Yes. No, great question, Rob. So the motion that we're running today is we're going to existing security customers where we have a strong anchor, a strong set of relationships. We're using those relationships to get to the broader central IT organization, either a CTO, CIO, sometimes Vice President of Operations, and we're showing them the value and opportunity of thinking about tool consolidation typically. And literally every customer that I talk to, they have tens of "Monitoring tools," using old words, but that's what they oftentimes have. And they're trying to figure out in this world where the digital footprint is growing rapidly, how do they get a single architecture that enables them to scale that broad digital footprint. And so you can't have a million different tools all doing different things. And so we run a broad play that enables us to show the value of Splunk and the value that you get by bringing the Observability Cloud in, integrated with the core platform, and how you can drive better resilience as a result of that. So that's the play we've been running. And we enter -- we start with the base of security and we move to observability versus the other way around. And I'll let Brian comment. We don't -- we haven't published any great metrics. There may be some other ways to think about it. But...

Brian Roberts

Yes. I mean we look at the attach, I think we feel good about the momentum there. But I think back to Gary's point, when we can sell -- successfully sell unified security and observability, it helps obviously increase ARR and it just makes that relationship even more sticky. And I think one thing that we saw in Q2, our renewal rate increased year-over-year, which we feel great about.

Operator

Your next question comes from the line of Joshua Tilton from Wolfe Research.

Unidentified Analyst

This is Patrick on for Josh. You all talked pretty extensively about your own directives to drive cost efficiencies. And we've obviously heard a lot about optimizations across the industry. From your perspective, have you seen customers looking to optimize their spend this point, whether it be with log injection or on the observability side? And then also on the observability side, do you find that you're replacing other vendors more often or homegrown solutions? Or is it kind of a mix of both?

Gary Steele

Yes. I think in this economic time, I think customers broadly are looking at how they can overall optimize costs. So I think that is definitely a conversation. A few things to note. One is when customers say, "Hey, I feel like my Splunk bill is big. What can you do to help me?" We really talk through our overall strategy which is how do you think about your data and where it lives? So through our federated search capabilities, we allow people to get access to data wherever it might live. So you can then think strategically about where is the lowest cost place for storage. Good example of that is S3 where we support federated search on to S3. And then coupled with that, Edge processor, one of the core capabilities of that solution is to reduce the level of data. So we go -- we lean into those conversations and really help our customers think through where they can optimize and save money. And then as you extend that broadly in observability, as I mentioned before, thematically, we see lots of tool consolidation kinds of opportunities where the outcome is reduced spend of vendors, and we're leveraging the Splunk platform to be able to drive that dialogue and win that. And then in terms of your question, on who the incumbent -- you basically see everybody as we go into these because big companies, so I think Global 2000 again, they have a broad range of what they would term as monitoring solutions. So you literally see everybody.

Operator

Your next question comes from the line of Brad Sills from Bank of America.

Bradley Sills

And great to hear the commentary and interest level of observability. We certainly hear that from the channel. Would you classify that more as pipeline or deal activity that's already happening today? And if it is more pipeline, is there something on the horizon here on the road map that could potentially be a catalyst to convert that pipeline? Or is this just a gradual effort to continue to integrate observability with the core security suite?

Gary Steele

Yes. No. Great question, Brad. So what I would say is, just go back to our prepared remarks, we had some amazing wins with our observability solution in the current period. At the same time, because of the broad interest level, pipeline continues to grow as well. And so I would say it's a little bit of both. Like we've had really good adoption and we're getting good reception. This play of doing tool consolidation has been working well. I think that's what's driving pipeline conversion in the short term. And then we're on a long journey to continue to deliver new cool capabilities that make the observability experience that much better. And so I don't know that there's any one thing that anybody is waiting for, Brad. I feel like the maturity of where we are today versus a year ago is amazing. And I feel like we've got a really good setup as we head into the second half and into next year.

Bradley Sills

Great to hear, Gary. One more, if I may, please. If you could just remind us how the macro has impacted the business. Are you talking about elongated sales cycles, smaller deal sizes to get deals through. And coming out of the macro, could we potentially see some acceleration as those things come back?

Gary Steele

Yes. So I would say the macro environment has been largely consistent this entire year. And what that means to us has been we've seen choppiness in cloud migrations, meaning customers, cloud migrations, they will defer them if they can because it represents an incremental project. There continues to be a lot of deal scrutiny, meaning additional sign-ups, et cetera. I think, though, having said all that, as we described earlier, I think our team has done a really good job of navigating through that. And so I think we've been able to deal with it reasonably well.

Brian Roberts

Yes. I think in terms of -- when you think of the second half of the year, I have -- there's no one out there thinking the macro environment is going to get better. And so I think we have to keep that in mind in terms of how budgets are set for calendar '24. So we're not going to provide guidance today for next year, but stay tuned for Investor and Analyst Day on January 9.

Operator

Your next question comes from the line of Pinjalim Bora from JPMorgan.

Pinjalim Bora

Congrats on the quarter. I just wanted to ask you about the renewal portfolio overall. Maybe talk about the performance. I think you said renewals rate improved year-over-year. Was that for the whole portfolio or just cloud only? And any comments on kind of sequential improvement in renewal rates?

Brian Roberts

Sure. So that renewal is dollar based, and it's the full portfolio. So it's all and it did increase year-over-year. So again, we're feeling really good in terms of the value proposition. And just back to Gary's point, how we're executing in this macro environment. And this is a year where renewals should grow in terms of the opportunity roughly 20% this year.

Operator

Your next question comes from the line of Keith Bachman from BMO.

Keith Bachman

Many thanks, Gary and Brian, I wanted to ask about some of the drivers of growth. And what specifically want to zero in on net new logos or net new customers, I should say. And so we have the metrics for large customers. But I was wondering if you could just -- if you could speak to the breadth of customers. Are net new -- are the net new logos or new customers in entirely growing because it seems like if I just take your cloud DBNRR, which isn't reflective of total ARR. But if cloud DBNRR is in the mid-teens, and you're guiding to total ARR growing kind of in that same rate, if you could just speak to the customer breadth underneath the largest customers? And the co-related question is, if you could speak a little bit to the competitive environment. Because are you seeing more competition stay at some of the smaller customers, whether it be Microsoft or anybody else that you want to call out? That's it for me.

Brian Roberts

Yes. I'm happy. I'll take the new customer, and then I'll pivot back to Gary to cover the competitive environment. I would say I think it's important when you're looking at DBNRR for us, remember, it's a trailing 12-month base -- 12-month metrics. So it's literally the weighted average of the prior 12 months. The way we look at it, new customers continue to drive growth. From an ARR perspective, new customers generally account for roughly 20% of net new ARR on a trailing 12-month basis, and we were pleased that in Q2, this metric increased year-over-year. And I'll let Gary touch on that environment.

Gary Steele

Yes. On the competitive side, I would say the competitive environment was largely consistent with what we've seen this year. The players that we see in the observability market have remained consistent. And then on the security side, I would say consistent as well. And even as you go to new customers, you will see incumbents there. You might see some legacy SIEM vendor that we then take out in place, that's been pretty consistent. So I would say there's no -- there's been no big fundamental change competitively.

Operator

Your final question comes from the line of Trevor Walsh from JMP Securities.

Trevor Walsh

Gary, maybe for you. You mentioned the SEC new regulations around public companies and reporting of incidents. I imagine Splunk's kind of on the tip of the spear of that being assumed and kind of the collector of all the information and alerts coming in. How much risk is there with -- within that process, you're probably only going to be as good as the data coming in. So how much risk is there around the other tools within the security stack, whether it's endpoint, network or being either not properly tuned or maybe not quite best of breed, and that kind of maybe poor or less high fidelity data getting pumped in? And Splunk kind of bears the burden of kind of dealing with all that and maybe the reporting process kind of being maybe not as good as it could be from that perspective, just given that you're kind of -- again, the tip of the spear, the clearinghouse of all the data kind of coming in.

Gary Steele

Yes, Trevor, really good question. So I think if you just step back, I think the one thing that we're very positive about is this new SEC really, really drives organizations to think through what is their strategy, if there's an event and how quickly can they actually understand and then provide broad SEC -- the SEC a broad viewpoint on where they stand. So I think that's the number one thing. And one of the things we're getting very good at is helping customers mature their security environment. So to your point, everyone's mileage varies and how mature they are. I think one of the kind of the key -- really interesting and exciting opportunities for us is we're very much focused on helping our customers drive that maturity journey to get the most value out of Splunk. And through that, they get the visibility they need to make those determinations because there's lots of places where, as you described it, you could have lack of visibility because you didn't get the right data in or you didn't get the right alerts. We have a very prescriptive program that we're driving with our customers to ensure that they're getting themselves set up correctly and helping them through that journey. And that's a very important motion. We've even accelerated that motion given this new SEC ruling. That was something we had in place prior, but we're accelerating that.

Operator

And we have no further questions at this time. Gary, I'll turn the call back over to you.

Gary Steele

Great. Thank you. I just want to take a moment and thank everyone for joining us on the call today. We look forward to seeing you out on the road. We'll be doing a lot of Investor Relations work over the coming quarter and looking forward to seeing you soon.

Operator

This concludes today's conference call. Thank you for your participation, and you may now disconnect.