Cisco andSplunk

What Splunk sells

Software records what it does. A user signed in, a request failed, a server restarted at four in the morning. These records are called logs, and a large organization produces them in volumes no person could read. Splunk collected logs from across an organization's systems and made them searchable quickly.

Why two budgets matter

Two groups pay for that capability, for different reasons. Security teams pay because the evidence of an intrusion is spread across many systems, and the useful question is what happened in sequence. That category is called security information and event management. Engineering teams pay because applications are assembled from many separate services maintained by different teams, so when something fails no individual holds the whole picture. Reading the record is the practical way to find out, and that category is called observability.

A product that serves two budgets in the same customer is harder to remove than one serving a single budget, because a cost reduction in one department does not end the relationship. Cisco described the combination in these terms. Its chief executive, Chuck Robbins, said that “our combined capabilities will drive the next generation of AI-enabled security and observability” (joint press release).

What analysts questioned

The reservations were about execution and not about the product. Jefferies' George Notter stressed the need for seamless integration, which he said had been mixed at Cisco historically. Barclays called Cisco's record in security and observability mixed. BMO noted near-term integration risk because Cisco's own AppDynamics and ThousandEyes overlap with Splunk's observability products, and Needham's Alex Henderson pointed to Cisco's record of realizing less than expected from earlier acquisitions (Benzinga, TipRanks).

That risk is real, and it follows from the difference between the two businesses. Cisco has sold network hardware for decades on a purchasing cycle measured in years. A software subscription is a different commercial motion, with different staff, different renewal dynamics and different measures of success. Hardware companies have attempted the transition before with varied results.

What the sale record shows

Splunk's proxy statement records how the price was reached (Splunk proxy statement). Cisco first made an unsolicited indication of $165 to $175 a share in December 2021 and raised it to $193 in February 2022. Splunk's chair countered at $212, and Cisco withdrew the same day. When Cisco returned in 2023 its first indication was $130, which the board's transaction committee judged not compelling. The committee decided not to run a market check, because it judged no other party likely to be interested. A series of offers and counteroffers in the last week of August ended at $157, a dollar below the $158 Splunk had said it would accept.

Two things follow. The $157 was a negotiated price with a single buyer and not the result of competition, so the premium measures what Cisco was willing to pay and not what the market would have paid. And it was lower than Cisco's own indication eighteen months earlier, which supports the view that Cisco was not paying for exceptional growth and that Splunk's own situation had changed.

The strongest objection

A skeptic can say that the two-budget argument is a justification found after the fact, and that Cisco simply paid cash for a large software business at a time when few large deals were being agreed. The 31 percent premium was lower than the 44 percent paid for VMware and the 63 percent paid for Red Hat, which supports the view that Cisco was not paying for exceptional growth.

The evidence that would decide between the readings is Cisco's reported annual recurring revenue and its disclosures on Splunk renewals. If renewal rates among customers that use Splunk for both security and observability exceed those that use it for one, the two-budget argument has support.

What a reader should take from it

For a software purchase, count how many separate budgets in the customer pay for the product, and check whether the buyer has run subscription software before. The first predicts how hard the product is to remove, and the second predicts whether the buyer can keep it.