Splunk is one of the most interesting companies in the cloud infrastructure software business over the last 10 years.

While today Observability and SIEM products are considered core industry niches, at the time when Splunk went public (2012), this seemed less obvious.

In particular, developers and practitioners were (and remain) quite invested in a variety of open source products that form the basis of their technology stack. There are also many practitioners, both on the DevOps side, as well as in cybersecurity who have quite different opinions compared to the vendors on what these terms really mean and whether it’s even appropriate to look at them from a software perspective, rather than workflows and process frameworks.

The big opportunity for Splunk was driven by the fact that they were the first closed source player to execute well on their strategy. Splunk was expensive and it was closed source, but an army of highly motivated sellers were able to get the product to be heavily adopted in an Enterprise context.

The closed source nature of the product slowly became a benefit, as many practitioners ended up adopting SPL (Search Processing Language i.e. Splunk’s query language) as an almost industry standard.

Building on this foundation, you would expect that Splunk would’ve achieved a “Palo Alto” level of entrenchment in its chosen industries. Yet they didn’t. Not only that, but fundamentally they ran a deeply unprofitable business as covered in “Strategy of Security”:

Back in 2016, SIEM looked like a good market for Splunk. Here's the Gartner Magic Quadrant for SIEM from 2016

Splunk's position in the "Leaders" quadrant was a cozy spot on the couch in front of the fireplace at a mansion in Vail. Splunk and LogRhythm were the up-and-comers, just out there chilling in the house enterprise tech players built. IBM, HPE, and Intel owned the mansion, but there was plenty of room for everyone.
Then, things got crowded. Microsoft entered the picture. Seven other startups raised $2.4 billion in capital.² Splunk and LogRhythm weren't the only up-and-comers anymore.
The three most recent Gartner Magic Quadrants for SIEM look a whole lot different than 2016:

Competition arrived, and the SIEM market became a pain to maintain and defend. Financially, the Splunk of the 2020s was a wildly unprofitable business. This chart compares Splunk's revenue and profitability (net income) over its entire time as a public company:

It tells you everything you need to know. Splunk has never (yep, never) had a profitable quarter. In January 2022, they spent $4 billion to earn $2.67 billion. Put differently, they had to spend $1.50 to earn $1. You don't need an MBA to know that spells trouble, cwapital T.
Cisco kicked off the beginning of the end with a failed $20 billion plus acquisition offer in February 2022.
Private equity entered the room shortly after. Silver Lake invested $1 billion in June 2022, "...eager to work with [Splunk CEO Doug Merritt] and his team to support Splunk’s next phase of growth."
Doug Merritt resigned five months later.
Pile on even more competition and the makings of a paradigm shift from SIEM towards security data lakes, and Splunk's situation starts looking a lot like the frozen wasteland of Alaska in 1867.

The tech sales insider view

I knew that Splunk would be getting sold to whoever was willing to pick up the bill years before they actually got there. Not because I worked for them, but because I competed against them.

There was a very clear shift in the quality of sales execution at Splunk towards the end of '21. While previously my company was regularly 30%+ cheaper in almost all head-to-head scenarios, we were struggling to displace Splunk because of the strong senior relationships that they had in those customers. It was often sufficient for the Splunk sales reps to deploy a FUD (fear, uncertainty, doubt) campaign where they would contrast the risk of "taking a punt on a risky small player".

This started to falter as a strategy after 2020 and they began to regularly lose renewal tenders/new bids. Customers wanted to expand and scale their deployments, but the costs were prohibitive, while the internal demand was high. So they started putting workloads with competitors such as my company.

As the panic started to seep in with their sales leadership team, the discounts started to show.

At first, they would be closer to us, but more expensive. Then they would price match. Then they would be cheaper. In the worst cases, they would be free. An outsider might look at it and say "well, they were running a high-margin business and got squeezed by the market to reduce their margin and maintain their leadership position".

But is this what happened? We already know they ran a deeply unprofitable business for essentially the full period that the company was public.

The only way out for Splunk was either to sell or lay off extensively (or both, as many learned the hard way).

However, the problem with layoffs is that when it comes to selling cloud infrastructure software, the loss of internal knowledge and competencies is often irreplaceable in the market.

The individuals who built, demoed, and sold Splunk for a decade are mostly gone. The product itself has barely changed, so we can't even say that "the company is bringing in new ideas and skills".

As of the time I'm writing this, the last moat for Splunk in large accounts is relying on Cisco's own deep entrenchment to maintain the subscription. The words "free renewal" and "significantly lower license cost" are now the norm when competing against them.

So what was arguably speaking the most high-profile success in Observability and SIEM back in the early 2010s has now become a giveaway line item. And it has everything to do with sales execution.

The quantified and qualified view

RepVue is one of the most interesting tools we have when analyzing GTM (go-to-market) organizations. As part of the process of submitting reviews, users would be asked to estimate what % of their team is making quota. This makes the metric a very effective way of gauging sentiment.

When comparing it with the real results behind the scenes for companies where I have that visibility, the sentiment is often 5-10% higher than the actual outcome. I presume this is happening partly because there's a selection bias in the RepVue sample for upper-percentile performers. The type of sales rep who is actively spending time trying to research companies and identify what good looks like is more likely to be displaying other behaviors that help them overperform "the average".

Looking at the graph, it's clear that we have more ratings from Q1 '2021, which means that the 50% attainment is probably close to the actual metrics in place.

Now this period overlaps with two trends:

Relative high growth of revenue
The highest losses ever incurred by Splunk

Let's take a look at the feedback on the ground:

The trends are obvious. Leadership with little to show for and widely despised by the sales teams. Reps who joined because Splunk was known to pay well but were then disappointed when they found out about the lack of success within the company.

This is where we hit the sales execution part the most.

No real pipeline.

No real strategy on how to generate pipeline.

Poor hiring on the sales management side.

Overpaying for bringing-in only “easy” revenue (renewals and upsells to deeply entrenched customers). Unable to deliver a vision or a product that could compete for new business.

Now remember what I mentioned about being somebody who competed against them during this period. All of these renewals were aggressively sold over time with bigger discounts in order to "save the account". So even when they were closing deals, those transactions were mostly unprofitable.

This is a company that was unable to adapt its business model and re-adjust its GTM strategy to respond to the market changes.

Burning money in order to keep the pretence that what made them successful in the 2010s remained firmly in place in the 2020s.

All of this was very visible if you paid attention to the day-to-day reality of tech sales.

Conclusion

Over the last 5 years, Splunk's stock underperformed even a basic SP500 index fund.

An alternative investment in Crowdstrike for the same period would have brought an annual average return of 33.8%. This is still accounting for literally one of the most public outages to ever happen in the industry and had a massive impact on their stock performance this year.

Splunk's overall performance looks even worse when we account for the fact that most of the gains occurred because of the acquisition that drove the price up.

Even if we account for the full stock activity since IPO, Splunk barely outperformed the SP500. For a company that had one of the most visible and successful runs into the cloud infrastructure space, this is unacceptable.

The best way to qualify this outcome was to take a deep and hard look at their sales execution, both tactically and strategically. Instead, in the investor community, analysts were talking about the "quality of the product" and "the deep strategic relationships" of the company.

What they missed was the burned partner relationships. The overpaying for renewals. The bad inbound flow. The churning customers for cheaper and better-performing products. The slow degradation of the sales culture and identity.

In their defense, unless you were in the tech sales arena, there were limited ways to understand this dynamic. Today, I think that we have an improved access to this type of actionable information. It just requires being open to evaluating the investment opportunity in a company from the perspective of a new mental model.

The tech sales perspective.

The Tech Sales Newsletter #60: The downfall of Splunk

The tech sales insider view

The quantified and qualified view

Conclusion

The Tech Sales Newsletter #61: Tech sales culture starts with hiring

The Tech Sales Newsletter #59: 2H’24 State of GenAI in Enterprise