Splunk Inc. (SPLK) Q2 2022 Earnings Call Transcript

Splunk Inc. (NASDAQ: SPLK) Q2 2022 earnings call dated Aug. 24, 2022

Corporate Participants:

Ken Tinsley — Head of Investor Relations

Gary Steele — Interim Chief Executive Officer

Jason Child — Chief Financial Officer

Analysts:

John DiFucci — Guggenheim Securities — Analyst

Raimo Lenschow — Barclays — Analyst

Brent Thill — Jefferies — Analyst

Phil Winslow — Credit Suisse — Analyst

Matt Hedberg — RBC — Analyst

Unidentified Participant — — Analyst

Mike Cikos — Needham — Analyst

Brad Sills — Bank of America — Analyst

Steve Koenig — SMBC Nikko America — Analyst

Gray Powell — BTIG — Analyst

Fatima Boolani — Citi — Analyst

Yun Kim — Loop Capital Markets — Analyst

Presentation:

Operator

Good day and thank you for standing by. Welcome to Splunk Inc.’s Second Quarter 2023 Financial Results Conference Call. At this time, all participants are in a listen-only mode. After the speakers’ presentation, there will be a question-and-answer session. [Operator Instructions] Please be advised that today’s conference is being recorded.

I would now like to hand the conference over to your speaker today, Ken Tinsley. Please go ahead.

Ken Tinsley — Head of Investor Relations

Thank you, operator, and good afternoon. With me on the call today are Gary Steele and Jason Child. After market closed today, we issued our press release, which is also posted on our Investor Relations website, along with supplemental material. This conference call is being broadcast live via webcast, and following the call, an audio replay will be available on our website.

On today’s call we will be making forward-looking statements, including financial guidance and expectations, including our long-term growth and profitability, our forecast for our third quarter and full year of fiscal 2023 and our future expectations of revenues, cloud mix, total ARR and cloud ARR, cloud gross margin, operating margin, operating and free cash flows and Rule of 40 scale, as well as trends in our markets and our business, our strategies and expectations regarding our business, products, technology customers, demand and markets. These statements are subject to risks and uncertainties and based on our assumptions as to the macroeconomic environment and reflect our best judgment based on factors currently known to us.

Actual events or results may differ materially. Please refer to documents we file with the SEC, including the Form 8-K filed with today’s press release. Those documents contain risks and other factors that may cause our actual results to differ from those contained in our forward-looking statements. These forward-looking statements are being made as of today, and we disclaim any obligation to update or revise these statements. If this call is reviewed after today, the information presented during this call may not contain current or accurate information.

We will also discuss non-GAAP financial measures which are not prepared in accordance with generally accepted accounting principles. A reconciliation of GAAP and non-GAAP results is provided in the press release and on our website.

With that, let me turn it over to Gary.

Gary Steele — Interim Chief Executive Officer

Good afternoon, and thanks for joining today’s call. Q2 was my first full quarter as Splunk’s CEO. After four months of leading this incredible team of Splunkers and meeting with more than 100 customers in 100 days, the reason that drove my decision to join Splunk are as true now as they were the day I started. Splunk is deeply embedded within the tech stacks of the world’s largest enterprises. Looking across the software landscape, I am confident that we are uniquely positioned for long-term durable growth and profitability. Our customers appreciate what we do for them and they are looking to invest more and drive greater value with Splunk.

Why? Well, simply put, no one else can do what we do. The value we bring to customers is evident in our second quarter results with total revenues growing 32% to $799 million, exceeding our expectations. Our team achieved this top line outperformance while also exceeding our op margin expectation for the quarter as our focus on balancing growth with profitability began to deliver.

We continued to see good customer engagement during the quarter with strong competitive win rates consistent with what we’ve seen in the past couple of years, a high net retention rate and good business momentum. We ended the quarter with 723 customers with total annual recurring revenue or ARR of more than $1 million, up by 33 customers from last quarter and up 24% year-over-year.

Despite our solid top and bottom line, our cloud ARR and total ARR came in short of our own expectations. This is largely due to the slowing of a number of larger cloud migrations and expansions as customers became more cautious with their Q2 budgets. As many of our customers opted for shorter-term commitments with Splunk beginning in the second half of the quarter, this lower-than-expected cloud adoption resulted in lower Cloud ARR and as a result, total ARR.

Our customers tell us that they understand the importance of moving to the cloud and that they remain on their path to migrate and expand their highly complex infrastructure over time. Cloud transformation is a time- and cost-intensive strategy as we’ve talked about on these calls, and we support the pace our customers take. Even given near-term pressures, our high competitive win rates indicate that our customers continue to choose Splunk.

To offer further context, today, I’m going to focus on what I’m hearing from my customer conversations and the changes I’ve been driving inside and outside Splunk during my first full quarter leading the business. First, as a recurring theme with my conversations, Splunk and our products are mission critical. Organizations rely on our unified security and observability platform to navigate today’s unpredictable world, and customers are eager to partner with us. We are deeply embedded into business processes, tech stacks and security and IT strategies of the largest and most innovative organizations on the planet.

Our criticality has been most evident in my conversation with leaders I personally know best, chief information security officers. Today’s Board and chief executives are empowering their CSOs to make buying decisions beyond their legacy security specific technology and across the business, often in partnership with the CIO. Our unique combination of security and observability products provide CSOs with unparalleled visibility and the depth of detection and response that modern organizations demand.

For example, just last month, I met with the CSO, CIO and CTO of a Fortune 50 transportation company and a longtime Splunk customer. Splunk is helping them improve business-critical board-relevant metrics like mean time to detection and mean time to resolution. As these leaders told me, we are integral to their security and observability and enable broader resilience across the Company. The customer continues to expand on the Splunk Platform as their security and durability needs continue to grow.

Equipped with end-to-end visibility across security, IT and DevOps alike, our customers are able to react more quickly to unexpected events and adapt. Especially within the context of today’s macro environment and cost constraints, organizations have less margin for error. Any disruption could be devastating. We help our customers improve the resilience of their critical systems, making our technology all the more relevant and mission-critical across the organization.

Last quarter, we hosted.conf and our Global Partner Summit in Las Vegas. I spent a week meeting with our customers and learning more about their challenges and the unique value we deliver. Our customer CSO, CIOs and CTOs, together with the industry analyst community, really responded favorably to the value we showcased and the innovations we delivered at.conf, along with RSA in June and even Black Hat earlier this month. During the quarter, Gartner ranked Splunk number one in both IT operations and security markets and the Gartner Market Share Report.

Now let’s take a look at the few transactions from the quarter. In Q2, we closed a multimillion-dollar three-year Splunk Security and Cloud deal to secure a U.S. state government. Through workload pricing, Splunk will provide the scalability and flexibility they need to oversee security over 20 separate IT departments. Splunk’s end-to-end visibility helped us displace an incumbent and beat out a competitor as part of the deal.

On the Observability side, an international financial services company, that you all know very well, extended and enhanced their Splunk investment with a multimillion-dollar Splunk Observability deal. Despite a lower-cost offer from a competitor, we won by demonstrating our effectiveness, value and ability to provide customers full visibility.

Turning to the Splunk Platform. Last quarter, one of New Zealand’s largest banks expanded their use of Splunk Cloud after using ITSI and enterprise security across the business. The bank will now leverage Splunk across its new banking platform to support its micro services development adding to its existing audit and regulation compliance use cases on our platform.

In the second half of the year, you’ll see us remain agile and disciplined in delivering best-in-class solutions to customers as they navigate today’s unpredictable macro landscape. When it comes to how Splunk goes to market, the immediate change I’ve set in motion since joining has been to double down on our CSO relationships and realign our resources to help them tackle their most urgent challenges. Again, security is a data problem and CSOs need Splunk.

We’ve also observed that given today’s threat landscape, CSO’s budgets are among the most resistant to changes in the macro environment. It should be no surprise that security is already our primary customer use case today, and we believe that it will continue to be in the future. We have begun to see that the world is changing and cybersecurity is coming together with observability to drive better business resilience for our customers.

As we help our customers improve the security and resilience of their critical systems, we’re also continuing to drive efficiencies within our own internal operations. This is consistent with what you’ve heard from Jason and the team over the past quarters as we have focused on our operating expenses and multiyear transition to become a multi-cloud and hybrid company.

Remember, it’s because of our own business transformation that our customers are able to migrate and expand their Splunk instances and use Splunk to support their other large cloud migrations. As such transformation continues to scale across the global community, it is essential that my leadership team and I continue to serve as a force of stabilization, both to customers and to our own Splunkers.

Now let’s take a look at the Splunk team following our CEO transition and the rebuilding of parts of our leadership. I’ve been focusing on our staffing structure and sales capacity. While we continue hiring across Splunk, our quota-carrying and customer-facing teams are our highest staffing priority. This and further operational updates, as Jason will address, led to a higher operating margin in the second quarter.

To close, despite a few headwinds this quarter, we experienced good customer engagement as evidenced by consistently high net retention and competitive win rates and solid momentum with large orders overall. As we continue to make progress on our own business transformation, we’re focused on taking a balanced approach to operations and efficiencies.

With that, I’ll hand the call over to Jason.

Jason Child — Chief Financial Officer

Thanks, Gary. In the face of some clear headwinds, our execution in Q2 was solid. And with the continuing normalization of our revenue model plus good progress on our expense optimization efforts, we substantially outperformed on the top and bottom lines for the quarter, and we’re increasing our outlook for revenue, margins and cash flow for the second half.

In Q2, total revenues were $799 million, up 32% over last year, significantly higher than expected, reflecting higher license revenue from term contracts. Cloud revenue was $346 million, up 59%, reflecting continued adoption of our Cloud Platform. Note that professional services and education were 7% of total revenues in the quarter.

RPO bookings was $794 million, up 17% over last year, which was lower than planned as several customers slowed their expansions or significant deployments due to macro uncertainty. This caution was also apparent in our shorter contract duration, which was down about two months versus last year. On a duration-adjusted basis, RPO bookings growth was 29%, just to give you a sense of the impact on total bookings.

That said, our renewal and expansion rates continue at a very strong pace given our high customer value proposition. Our reported cloud DBNRR remained consistently high at 129%, with our overall DBNRR a few points lower due to a slower pace of cloud migrations. We ended the quarter with total ARR of $3.33 billion, up 27% year-over-year and Cloud ARR of just over $1.5 billion, up 55%. As Gary mentioned, we had 723 customers with ARR greater than $1 million, up 24% year-over-year and 352 of these customers had Cloud ARR over $1 million, up 50% over last year.

On to margins, which are all non-GAAP. Cloud gross margin was 69% in Q2, up nine points from last year, tracking well to our target of 70% by year-end as we continue to realize leverage from the scale and the elasticity of the Cloud Platform. Total gross margin was 79%, up three points year-over-year and reflecting the sharp improvement in Cloud margin. Operating margin was positive 4% in the quarter, significantly better than our expectation due to our top line performance, plus good execution on the expense optimization efforts that Gary has helped install as part of our balanced growth and profitability focus.

Turning to guidance. For the remainder of the year, with the macro-related uncertainty and changes in customer buying patterns, we are adjusting our full year total ARR target to $3.65 billion and Cloud ARR to $1.8 billion. The majority of the ARR adjustment is primarily attributable to a slower pace of existing customer migrations and expansions of their cloud deployments given the uncertain economic environment. Given this, we are now expecting an ending cloud mix closer to 60% this year compared to our initial estimate of around 70%.

On the income statement, with the continued normalization of our model and given the revenue outperformance in the first half, we are increasing our full year revenue expectations by $50 million to between $3.35 billion and $3.4 billion. Combined with our ongoing expense efforts, we now expect a non-GAAP operating margin of approximately 8% this year, up from our prior target of 2%.

Just to impact some of the details around our expense initiatives and what’s driving leverage, some of the areas we’re focused on include rationalizing usage of outside services for only the most critical projects, limiting T&E to customer-facing travel and support, and then we’re also taking a more thoughtful approach to hiring increasing overall sales capacity. In the past, we’ve been aggressively adding new headcount and now we’re more closely scrutinizing requirements and our ability to leverage existing capacity.

And finally, we’re assessing our global real estate portfolio and rightsizing space for our post-pandemic return to office needs and opting for serviced offices where it make sense. We don’t believe any of these efforts will impact our overall growth rate. For cash flow, we expect our improving op margin to translate to stronger cash flow. So today, we’re also raising our full year operating cash flow target by $20 million to $420 million.

And to highlight the historically light capex requirements of the business, today, we are introducing free cash flow as the primary cash generation metric going forward. This move also highlights our focus on the balanced growth and cash flow capabilities of our model. We expect to generate free cash flow of at least $400 million this year. And with the updated guidance we provided, we’re now tracking to 38% on the Rule of 40 scale.

For Q3, we expect total revenues of between $835 million and $855 million, with non-GAAP operating margin of between 6% and 8%, reflecting cost efforts and continued profitability improvement. In closing, in the face of a few headwinds, execution in Q2 was solid and operating leverage in our model is improving and returning to pre-transformation levels.

With that, let’s open it up for questions.

Questions and Answers:

Operator

[Operator Instructions] And our first question comes from John DiFucci from Guggenheim Securities. Your line is now open.

John DiFucci — Guggenheim Securities — Analyst

Thank you. I think this question kind of goes to both of you, both Gary and Jason. We understand like the macro backdrop slowing a bit. But — and it makes a ton of sense, Jason, you’re really clear on why you’re raising revenue versus reducing the ARR, it’s due to the mix shift, and that makes a lot of sense too. But it sort of begs the question, why? Like why are customers hesitating to mix — to shift more to cloud? Or why are they shifting less than you thought they would or less than they have been? Does it have anything to do with their confidence in Splunk Cloud? Or is there — I don’t know, something greater there?

Gary Steele — Interim Chief Executive Officer

No, this is Gary. I think it’s pretty straightforward. What we saw was that as we work through these larger customers that have very complex Splunk in limitations, they want to have a high volume of data. We today have customers ingesting a petabyte — over a petabyte a day into Splunk. That, combined with the range of applications that have been developed under Splunk, those are pretty complex migrations. And so what we saw was people just putting that off. And that’s not — that showed no lack of confidence in Splunk or the willingness or wanting to expand. It was really just a timing thing. Jason, what would you add to that?

Jason Child — Chief Financial Officer

Yes, John, I would just add that, again, the renewal rates actually were right in line with where they’ve been and actually right on plan. It’s really the cloud migrations and then some of the expansions on workloads that were — the customers want to move into cloud. Given kind of uncertainty, we just saw a little more of an elongated sales cycle and a little more of a desire to kind of be a little more cautious on making those investments now versus doing it sometime in the near future.

John DiFucci — Guggenheim Securities — Analyst

If I might, just a quick related one follow-up. Scrutinizing some of your own expenses make sense, too. The one thing you didn’t — I don’t think you mentioned and I was kind of glad you didn’t, but I just want to ask around R&D investment. Because obviously, Splunk is a technology company, and you have a lot of offerings that I think, needs some more integration and you’ve had changes at the top of the product area. I was just wondering if how you think — and maybe, Gary, this is for — how do you look at investment in R&D? And how do you think that plays out over the near to medium term?

Gary Steele — Interim Chief Executive Officer

Yes. No, I think to your point, innovation is a critical piece of our overall strategy at Splunk. We also think that’s a — that aspect will continue to fuel long-term durable growth. So, we will continue to invest in R&D. And one of the things that as part of my focus has been driving leadership and organizational change to help us drive better execution on the R&D front. And but at a very simple level, we’ll obviously keep investing in products and technology because that’s what our customers rely on.

John DiFucci — Guggenheim Securities — Analyst

Great, thank you very much guys.

Gary Steele — Interim Chief Executive Officer

Thanks, John. Good to have you back.

Operator

[Operator Instructions] And our next question comes from Raimo Lenschow from Barclays. Your line is now open.

Raimo Lenschow — Barclays — Analyst

Hi, thank you and yeah, good to see John back as well. The — two quick questions. So can I stay on that cloud migration towards like what does it tell me about the value that customers are seeing? Or like how much work is involved in this migration? Because you would think like cloud is kind of where everyone wants to go, so why would I slow that down? Maybe could you speak to that a little bit?

And then one for Gary as well. You kind of talked about a greater focus on the CSO. Can you talk a little bit about how that plays into that bigger observability theme? And I did ask last quarter already, but like maybe you can address it more like how CSO and observability kind of are related because I got a lot of questions from investors around that refocusing that.

Gary Steele — Interim Chief Executive Officer

You bet. So cloud is definitely a priority for our customers, and they see a multi-cloud hybrid environment as their — is where they’re headed. And so I think it’s actually pretty simple in that these customers have very complex Splunk environments because of the range of applications that have been developed and the volume of data they have. And there’s just work required to do that. And that actually costs something, that’s not free, that work to get the migration done.

And so it’s just a timing of when those migration efforts will begin. They are — what — the one thing that I saw very consistently is that customers want to go to Splunk Cloud and that there’s a high desire to get there, it’s just a determination of when. And then going — Raimo, to go to your second question regarding CSO, we’re seeing a couple of trends here that we think are really important.

One, and we referenced this in our prepared remarks, we are beginning to see more CSOs owning the broad data set for which companies are driving broader business resilience initiatives, and business resilience really spans thinking about how do you protect yourself from some form of cyber activity, including breach but also how do you ensure that your applications are up and running at all times.

And the issue that we see now more frequently is when some event happens, organizations need to determine very quickly is it a cyber-related event? Or is it some form of application outage. And so the commonality here is single data set across both of those environments. And our alignment to CSOs is where we’re always anchored and so it’s obviously a very good place to enter an organization and then enables us to then drive a broader observability conversation across the organization.

Raimo Lenschow — Barclays — Analyst

Okay, makes sense. Congrats, thank you. Thanks, Raimo.

Operator

And our next question comes from Brent Thill from Jefferies. Your line is now open.

Brent Thill — Jefferies — Analyst

Gary, on some of these cloud pushouts, if you kind of double-click into those and looked at competitive win/loss and also if you look at execution, is there any factors playing into the sales team’s efficiency on this or some of these customers saying they’re going in a different direction? Or do you feel like, hey, that you check that box, and that’s not a concern for you?

Gary Steele — Interim Chief Executive Officer

Yes. It’s absolutely not a concern for me. So as we indicated in our prepared remarks, again, we saw competitive win rates stay the same. We did not see competitors changing the impact on those decisions. And I would go back to the point that Jason had made that a renewal rate stayed incredibly consistent. And so when you look across all of the metrics, it really bodes for the fact that people are just simply taking a little more time as they think about these cloud migrations. It really has nothing to do with competitive or nothing to do with willingness to continue to expand and invest in Splunk.

Brent Thill — Jefferies — Analyst

Okay. And just a quick follow-up. The on-prem piece seems really strong, and that — can you just balance that dynamic of what you’re seeing there?

Gary Steele — Interim Chief Executive Officer

Yes. I think the one thing that’s really clear to me, so in my 100 days and 100 customer meetings, which was kind of amazing, the one thing that was really clear is that the customers that we serve today will be hybrid for a very long time. And so, cloud will play a very important role for them, but as well they’re on-prem. And the one very cool thing that uniquely differentiates Splunk is the ability to use Splunk across this multitude of environments and do so in a seamless way. And it really goes back to even features that we introduced at.conf where things like Federated Search, edge actions, all those things really give us an advantage in this world that is complex and hybrid.

Operator

And our next question comes from Phil Winslow from Credit Suisse. Your line is now open.

Phil Winslow — Credit Suisse — Analyst

I just wanted to focus on new customer wins. Obviously, your dollar-based net retention was strong again this quarter, but you mentioned slowdown of expansions expected in the second half. What are you seeing in terms of new customer wins in the first half? And then we look at your cloud guidance for the second half, how much of it is a slowdown in just that dollar-based net expansion that you all talked about is also potentially any sort of change in, call it, new logo wins?

Gary Steele — Interim Chief Executive Officer

Yes, Phil, interesting. What we saw was very consistent new logo wins across the first half. So there was nothing different in Q2 than what we saw in Q1. And I’ll let Jason dive in here if he wants to add color on that.

Jason Child — Chief Financial Officer

Yes. I mean if you look specifically at ARR and contribution coming from existing versus new customers, we’ve, I think, said historically that roughly 80% of any given kind of bookings or ARR in a given quarter, roughly 80% comes from existing customers and expansions and 20% comes from new. That’s been pretty consistent, and it remained consistent in Q2.

Phil Winslow — Credit Suisse — Analyst

Got it. And then going back to just the question about sort of any sort of slowdown with the — on the expansion side or even the new logo win. Are you seeing sort of a slowdown because you’re potentially also seeing elongation in sales cycles, not just simply because of slowdown in cloud because of more components to your point, Gary, sort of selling observability and security? Or is this just sort of a high-level slowdown not having to do with, call it, incremental components from Splunk?

Gary Steele — Interim Chief Executive Officer

When we look at the slowdown, it was really these — specifically these cloud migrations, where customers planning a big migration, it just takes time. And so, it wasn’t related to additional components that ultimately made the deal more complex or anything like that. It was really — these cloud migrations were just big, lots of data, lots of applications, all that need to be moved. And it’s a project that requires staffing both on the customer side and oftentimes, the addition of support professional services resources to assist.

Operator

And our next question comes from Matt Hedberg from RBC. Your line is now open.

Matt Hedberg — RBC — Analyst

Jason, for you, I’m wondering if you — is there any way for you to quantify the impact of some of these slowed or delayed cloud implementations in the quarter? And have any of them closed in Q3? Or are you expecting some of these to sort of maybe push out into next year — next fiscal year?

Jason Child — Chief Financial Officer

Sure. So if you look at Q2 results, the expectations on ARR versus where we came in, we missed by roughly 40-ish million. Roughly about 80% of that came from cloud. And then within cloud, the majority of it did come from cloud migrations. So our guidance really is just kind of flowing that through to the rest of the year. So, we’re basically making assumptions that any of these kind of — any of the pauses or kind of scrutinizing budgets and kind of delaying things, we assume that, that’s not going to be caught up necessarily in the next quarter or two.

So if something changes, we’ll see. But right now, our — kind of all the messaging we seem to get in the back half of was that there’s just a lot of folks pausing, I guess, a little bit like what we’re doing ourselves on some of our outside spend. And so hopefully, we’ll learn more about macro and what’s going to unfold in the second half, but we’re not making big assumptions on catch-ups in the near term.

As I think we said in a couple of the earlier questions, renewal rates are still very consistent. Expansion is just a little bit lower in the near term. But everything that we see indicates this is really about timing. And so, we think that once folks have maybe a little more confidence in the macro situation that will allow them to be able to make those expansions, which they can do any time. They don’t have to do it just on renewal.

Matt Hedberg — RBC — Analyst

Got it. Super clear. And then I think what gets missed in all this is this is becoming a much more efficient company. And you beat on profitability, taking cash flow up a bit. I think you outlined some of the cost-cutting things that you’re looking at. And I think what’s important is you don’t think any of it is going to impact top line growth. I’m wondering if you could — if you could sort of like talk about the time frame for some of these cost cuts because is it multiple years? Is it this year? Just sort of — any sort of sense for like where we are in that kind of that cost synergy equation.

Gary Steele — Interim Chief Executive Officer

Yes, Matt, great question. I think one of the things that I’ve tried to focus on in my first 90 days and first quarter was bring this more balanced perspective to how we can deliver long-term durable growth with increasing margins and cash flow. And there’s obviously — we saw in the quarter, there was low hanging fruit and opportunity. And as Jason outlined in his script, we’re focused on a number of areas. And some of these things, we’ll see immediate benefit from and some will take more time. So things like real estate, that takes more time because we have leases to unwind, etc. But other things like the uses of outside resources, contractors, etc., those can have more immediate effects. Jason, anything you’d add to that?

Jason Child — Chief Financial Officer

Yes. I think what you saw in Q2 is that we grow opex at roughly 5% year-on-year, very consistent with what we did in Q1. So this is — there’s a number of actions that Gary said, some of them are short term, some of them are longer term. We do expect to have pretty significant cost leverage going forward for the — I’d say, for the near future, definitely through the rest of this year and certainly well into the next year, too.

We’ll provide more insight on that when we provide guidance later in the year. But there’s certainly — I think you guys have pointed out that we’ve had a relatively high cost base and relatively low margin. And so this is certainly taking a time frame as we get more efficient. And then certainly, as Gary has brought in a really strong focus on a balance of growth and profitability, this is allowing us to really kind of stage and implement a lot of these different actions that we’ve been contemplating but now actually being able to realize.

Operator

And our next question comes from Michael Turits from KeyBanc. Your line is now open.

Unidentified Participant — — Analyst

Gary, this is Eric on for Michael. Great. So I just wanted to ask, Jason, a question. So I mean the license had some strong upside in the quarter and is understandable that the cloud migrations were a little bit less than you expected. But if I look at kind of your net new ARR growth, it seems like cloud was 90% or more the kind of the net new ARR growth. So I’m just trying to square the two in terms of the strong license revenue quarter versus it looks like a strong mix of cloud as a percentage of new ARR.

Jason Child — Chief Financial Officer

Yes. I think the short answer is term duration was better than we had expected, which is what really benefits the revenue line because ASC 606. And overall, on a comparative basis, I think I said about 80% of the ARR miss was cloud. There was still a little bit of slowdown in license and that, again, is going back to some of the macro uncertainty and some of the kind of cautious approach that we certainly heard from a number of our customers towards the end of the quarter.

Unidentified Participant — — Analyst

And Gary, if I could just ask you, is there any change in kind of customer behavior in terms of where they’re sending data, if not to Splunk? Are they using Ingest Actions at all? Are they using any other tools to kind of control the amount of data they’re sending to Splunk?

Gary Steele — Interim Chief Executive Officer

Yes. No, it’s a really interesting question. So one of the things we’re very focused on working with our customers to help manage their overall total cost of ownership. And so helping them think through where they want data to live over the long haul and how to then leverage these new features and capabilities that we’ve introduced like federated search, so probably a single Splunk console, you could get access to Amazon data sitting in S3.

And so we just see customers thinking very hard about where they want that data to live and how do they want to optimize their overall cost of the Splunk implementation. And these features that we recently released, we think have just — we’ve seen really positive feedback from customers. And so, we’re really encouraged by that. And I think it’s the right message for a customer given the volumes of data people want to put in Splunk.

Operator

And our next question comes from Mike Cikos from Needham. Your line is now open.

Mike Cikos — Needham — Analyst

You have Mike Cikos here. And just wanted to take a different tack on those elongated sales cycles or some of this caution we’re talking to with those cloud migrations. Can you help us think through the customer behavior? And really, is it tied more specifically to a geography or a specific vertical? Or is it relatively broad-based in nature when you’re looking at those customers that chose to delay?

Gary Steele — Interim Chief Executive Officer

Yes. No, great question. We saw pretty consistent behavior across geos. So the Americas, EMEA and APAC. And we didn’t see isolation to specific verticals. We — I wouldn’t characterize it that way. I think it was much more about the environment that people were thinking about migrating versus the vertical or the geo they were in.

Mike Cikos — Needham — Analyst

Very helpful. I appreciate that. And then if I could, with the follow-up for Jason. I know that we spoke to the ARR miss in Q2 and the expectations now with the reset for the full year. Curious if you could help us think through the contract durations there. Could you help us with any color as far as how those durations are expected to move or change as we look to 2H versus where we were in 2Q or even a year ago?

Jason Child — Chief Financial Officer

Yes. I would expect the durations that we saw in Q2, which were about kind of mid-to-high 24s for cloud and then mid-22-ish for term. I would expect to see cloud probably remain similar. Term, I think probably is somewhere — we’ve said for a long time, it’s something we don’t control. We don’t actually incent the sales folks since our sales force only gets a quota relief for 12 months. So it’s usually between 18 and 24. Our expectation is probably in that 20-ish to 22-ish range. But again, it’s not an easy number for us to forecast, given it really comes down to customer preference.

Mike Cikos — Needham — Analyst

No. I appreciate you pointing out it’s beyond your control. But thank you for helping us think through some of the parameters when you guys went about formulating that guidance. Much appreciate it.

Operator

And our next question comes from Brad Sills from RBC. Your line is now open.

Brad Sills — Bank of America — Analyst

This is Brad Sills from BofA. Just one on the macro, the commentary you provided here on some of the larger expansion deals. On the one hand, it sounds like you’ve got this larger footprint, more complexity, some of these deals, and that’s having an impact. And then on the other hand, there’s some macro, it sounds like as well. Could you just help us parse through those two things? Would you say it’s one more than the other? And then were there any kind of commonalities and use cases? Was it outweighed to IT? Security was a bit more resilient. Any more color there, please.

Gary Steele — Interim Chief Executive Officer

Yes. What was interesting, and I noted this earlier in the discussion, we did see a change from what we saw in prior quarter. And so, this really all started basically in the last month of our quarter. So when we started to see different buying behavior and elongated sales cycles, deals pushing, it was really in the last month. So, I think — so I would then attribute that very much to macro versus the circumstances surrounding the customer because it was very different than what we had seen in prior quarter.

Brad Sills — Bank of America — Analyst

Understood. And there was nothing —

Gary Steele — Interim Chief Executive Officer

And then going back to your second part of your question, which was, was it more IT or security it’s very difficult in our environment to pull those apart. But I would say, generally, it was more IT-oriented than it was security-oriented, but that’s very qualitative on our part because we don’t have perfect metrics on this one.

Brad Sills — Bank of America — Analyst

Makes sense. Makes sense. And then one more, if I may, please. One of the categories that you mentioned you’re focusing on to kind of drive efficiency here, sales productivity. I wonder if you could just elaborate a little bit more on that. Is that just simply a larger footprint that you now have available with observability to sell into some of these renewal expansion deals and you generate more productivity that way? Or is there something else we should be keeping in mind?

Gary Steele — Interim Chief Executive Officer

Yes. I think it’s really simple on our side is just how do we continue to grow capacity to take advantage of what is a great market opportunity and how do we align our resources appropriately to take advantage of that. We’ve — and I think with that, you’ve heard on these calls, we want to make sure that we’re well aligned to the security buyer, that’s also important. So I think it’s really just alignment around the opportunity.

Operator

And our next question comes from Steve Koenig from SMBC Nikko America. Your line is now open.

Steve Koenig — SMBC Nikko America — Analyst

I’ve got one for Gary, and then I’ve got a follow-up for Jason on financials. So Gary, the macro is affecting a lot of companies, not just Splunk and it tends to be in different areas. And sometimes, it’s the newer areas of their business where they aren’t as established. I’m wondering for Splunk, this — you’ve been on the board for a while, and you’ve seen this. This isn’t the first time that Splunk has seen some variability in terms of customers expanding in cloud or migrating to cloud. It has happened previously. And I’m wondering, what can Splunk do to get customers off the dime on Splunk Cloud and get those migrations and expansions accelerating? And then I have one follow-up, if you don’t mind.

Gary Steele — Interim Chief Executive Officer

Yes, so I haven’t been involved up until the last four months. So I wasn’t on the board or anything. So this is all brand new to me. But from my perspective — no, it’s all good. But from my perspective, for us, we’re really trying to make it as easy as possible for customers to do the assessment, understand what it takes to migrate and really do everything we can to assist them in that effort. And so, we think about that in the context of how do we bring services to the table, how do we bring the right partners to the table. And while a lot of that activities have been going on, we’re going to double down to make sure that we’re doing everything we can to support those efforts to get — using your words, get customers off the dime.

Steve Koenig — SMBC Nikko America — Analyst

Got it. Great. And then for you, Jason, just help me square your commentary that cloud expansions were lighter than expected as well as migrations. With the metric you gave on cloud dollar-based net retention was 129, which is really only one point lower than last quarter. So maybe help me square those things.

Jason Child — Chief Financial Officer

Yes. Steve, on the DBNRR — Cloud DBNRR, that is a trailing 12-month metric. That said, even on total within cloud expansion, very, very small changes from Q1 to Q2. It’s just — it is a very, very sensitive metric. And so in this case, what we had said was previously, we expected the year to end at about 70% cloud mix. Now we’re saying we think it’s going to probably stay around 60th percent. And so that is — that 10% differential is really what’s driving the difference. And we’ve talked in the past about how when someone moves to cloud, it’s about 1.5x versus on-prem or versus term.

And so that’s where the majority of the impact is. And when someone makes the cloud migration, that impact doesn’t show up in dollar-based net retention. Most of it is in overall and that’s because they haven’t been in cloud. And so therefore, they’re not really expanding the existing cloud. That’s why the impact is more filled on overall dollar-based net retention and less within cloud.

Operator

And our next question comes from Gray Powell from BTIG. Your line is now open.

Gray Powell — BTIG — Analyst

Okay. Great. So I got a couple here. Gary, I know you were not at Splunk back in early 2020, but I’d just be really curious. How does the environment today feel like what you saw relative to back then? And then I guess my follow-up would be, at proof point, you all had a very conservative guidance philosophy. So I guess the question is, is some of the ARR reset here, is that just related to your being at the Company for over a quarter now and officially putting your mark on the Company?

Gary Steele — Interim Chief Executive Officer

Yes, a couple of things. So going back to your first part of your question, Greg. So in terms of the buying environment today, I think we just see general concern about recessionary concerns, etc., that have flowed all the way to the CFO, and they’re scrutinizing and thinking through priority of spend. And I think that has — that’s what has led to the slowdown of these cloud migrations and expansions as we talked about. And then relative to guidance velocity, I think for me, been here 90 days, right? Like it’s — well, I guess, we’re working on four months now. And so, we need to be super thoughtful about our guidance going forward in this turbulent time. So trying to be thoughtful.

Gray Powell — BTIG — Analyst

All right. Fair enough. I had to give that one a shot.

Gary Steele — Interim Chief Executive Officer

Thanks, Gray.

Operator

And our next question comes from Fatima Boolani from Citi. Your line is now open.

Fatima Boolani — Citi — Analyst

Gary, to start with you, just with respect to the slower velocity of migrations and expansions, I want to focus more on the expansion piece. As a broad observation, we’ve heard from some of your peers around maybe some belt tightening on cloud adoption and cloud utilization and the so-called consumption models. I’m curious if you can comment on how that dynamic impacts your cloud business and your cloud expansion rate? And then I have a follow-up for Jason, if I may.

Gary Steele — Interim Chief Executive Officer

Yes. I think — it’s a really good question. I think what we’re seeing is people are being super thoughtful about how much they’re willing to commit on that expansion side. And it’s just — it’s — I think you’re using your words, the belt tightening, that’s effectively what we feel. And it’s not — obviously, we’re not in a consumption model, but people are trying to plan what their usage of Splunk will be over some period of time. And I think they’re trying to rein in what — and you probably understand is there’s so much passion within Splunk, within these organizations that lots of individuals across the organization who want to use Splunk and I think they’re trying to hold that back and be very thoughtful to pull back on how much they really need.

Fatima Boolani — Citi — Analyst

Fair enough. Jason, for you, I’d be remiss if I didn’t ask you about the renewals ACV pipeline that you’ve talked about for several quarters now. But just more in the context of free cash flow conversion, I believe you were at $1 billion, $1.5 billion on the renewals ACV. So I’m wondering why we’re not seeing, for lack of a better term, more on your free cash flow and free cash flow conversion as those renewals kind of come through the door after your durations on invoicing have normalized? And that’s it for me.

Jason Child — Chief Financial Officer

Thanks, Fatima. I guess on the renewal base, what we had said previously is roughly $1.5 billion, and that was set when customers first migrated from largely from perp to term and cloud roughly two to three years ago. Those folks are now coming due. We are — as I mentioned earlier, we’re seeing very consistent high renewal rates. So that hasn’t changed. The only thing that’s changed is we’re seeing a little less expansion to mostly tied to their, I guess, confidence in what their future data volumes will be.

And so that’s probably the thing that we saw most in Q2. We’ll see how that flows throughout the rest of the year. In terms of the impact on cash flow, I mean we did have that baked into our initial operating cash flow guide when we had $400 million as our target. We did take that up by $20 million this quarter, halfway throughout the year. And hopefully, we’ll be able to — as we deliver on these expansions and — renewal and expansions, then hopefully, we’ll be able to deliver continued cash flow growth throughout the year.

Operator

And our last question is going to come from Yun Kim from Loop Capital Markets. Your line is now open.

Yun Kim — Loop Capital Markets — Analyst

Gary, can you remind us your near-term strategy regarding your observability suite? Is slower cloud migration affecting your — that business? Are you fine-tuning your go-to-market around that given the you kind of pushed the combined security and observability push since you’ve been on board?

Gary Steele — Interim Chief Executive Officer

No, we see tremendous opportunity on the observability suite, and we’ve seen great adoption across IT, leveraging logs and then bringing in metrics, traces, etc. Nothing’s changed from our perspective about that opportunity. We’re incredibly enthusiastic about the competitiveness, and we’re seeing some great customer wins and we noted one of those in our prepared remarks today. So, we feel very, very good about that. There’s no fundamental change in our strategy there. And we want to continue to leverage the strength that we’ve traditionally had with logs to go capture opportunities more broadly across metrics, traces and the other components of the overall suite. So we feel really good about it.

Yun Kim — Loop Capital Markets — Analyst

Okay. And then, Jason, real quick, just to be clear, when customers are renewing their term deals, are they renewing at a typical three-year length? And just remind us the billing frequency around those term deals?

Jason Child — Chief Financial Officer

Yes. I would assume that the — in the appendix of the website slides that we released with earnings earlier today, you can see the durations for both cloud and term, I would assume that they’re consistent and expect that they will be consistent for the remainder of the year and that roughly 27-ish months range for cloud and 20 to 22 months or so for term. In terms of the invoicing, we billed on annual upfront for the next 12 months. And that’s a change that we made a couple of years ago. And the reason, of course, our cash flow went down as we used to bill everything upfront and then we went to annual front. And we’re now done lapping that and which is why you’re seeing our cash collection now start to normalize.

Operator

And I am showing no further questions. I would now like to turn the call back over to Gary Steele for closing remarks.

Gary Steele — Interim Chief Executive Officer

Thank you very much. I wanted to take a moment and thank everyone for joining us on the call today. We were pleased with the results we delivered even on the face of some macro headwinds and we feel like we have the right positioning given our balanced approach to growth and profitability. We look forward to talking with you all soon.

Operator

[Operator Closing Remarks]