Splunk to Be Acquired. When to Sell, What to Buy?

Looking for a quick and easy way to reduce volatility? Stop looking at your portfolio so much. In the world of tech stocks, this advice can go a long way towards helping you sleep well at night. Remember, it’s never over until the large-and-in-charge woman sings. For long-term investors with time horizons measured in decades, the “when to sell” decision is often resolved when an M&A event happens. That’s precisely what’s happening with one of the stocks we’re holding on – Splunk (SPLK).

Cisco and Splunk

Details matter, so always go to the horse’s mouth.

The above press release by Cisco (CSCO) talks about their plans to pay $157 a share for Splunk (a $28 billion purchase price), the company’s largest acquisition to date, and a deal that’s expected to “accelerate Cisco’s business transformation to more recurring revenue.” So, why do shares of Splunk currently trade in the $146 dollar range? That 7% discount reflects the market’s uncertainty that the deal will close “by the end of the third quarter of calendar year 2024, subject to regulatory approval and other customary closing conditions including approval by Splunk shareholders.” That seems quite likely, and here’s why.

Our previous research talked about how private equity firm Silver Lake has played an important role in helping to finance Splunk over the years. A $1 billion note (convertible at $160 a share) was issued with Silver Lake’s Chairman joining the Board of Splunk, all of whom have approved the deal. No objections there, which leaves the decision to existing institutional shareholders, none of whom have enough votes alone to stop the deal. (Note that Vanguard and BlackRock – first and third largest shareholders of Splunk are likely passive investors.) The odds of some other company ponying up more than $28 billion in cash seems unlikely, so unless Cisco decides to pay more, we’re getting 7% on our money for holding until Q3-2024 (when the deal is expected to close) with a seemingly small chance of upside.

From a broader perspective, our exposure to SIEM/APM is now frozen, and we’re essentially invested in an instrument that will move based on the likelihood of an M&A event occurring a year from now. Perhaps we ought to consider what substitutes give us similar exposure.

Swapping Out Splunk

Here’s what we wrote last month when we checked in with Splunk.

As we concluded earlier this year, those with no dog in the race may find Datadog to be the best APM/SIEM play. We were long Splunk before DDOG became an option, so we’re sticking it out unless growth stalls or our thesis changes. 

Credit: Nanalyze

We generally look for leadership in any category by examining revenues and market cap. Coincidentally, Datadog (DDOG) has the same market cap as Splunk’s acquisition price – about $28 billion. When it comes to market share captured, Splunk has twice the revenues of Datadog. That’s reflected in the corresponding simple valuation ratios – Splunk at 8 and DataDog at 14. Our previous piece on 5 Application Performance Monitoring Stocks looked at how Cisco lost their leadership position in 2022 with Datadog and Dynatrace (DT) taking its place (at least according to some overpaid MBAs). The latest Gartner quadrant for Application Performance Monitoring and Observability shows positions shifting a bit with Dynatrace taking the lead, and that’s mimicked in this diagram by Forrester which describes the domain as “Artificial Intelligence for IT Operations,” and shows leadership along with market share (the size of the circle).

Naturally, that called for a follow-up piece – Datadog vs. Dynatrace vs. Splunk: The Best Stock Is? – which concluded that Datadog was the winner based on a simple set of metrics seen below.

	Splunk	Datadog	Dynatrace	Winner
Annualized Revenues	3.7	1.7	1.1	SPLK
Market Cap	14.8	22.6	10.7	DDOG
Simple Valuation Ratio	4.0	12.9	9.6	SPLK
Gross Retention Rate	N/A	Mid-High 90s	N/A	N/A
Net Retention Rate	127%	130%-plus	120%-plus	DDOG
Total # of Customers	15,000	22,000	3,000	DDOG
# of Customers Over $100K	N/A	2,600	N/A	N/A
# of Customers Over $1 million	754	216	N/A	SPLK
Last 5 years revenue CAGR	15%	59%	18%	DDOG
Cash	1.7	1.7	0.6	N/A
Debt	3.3	0.8	0.3	N/A
Avg gross margin last 4 quarters	80%	80%	84%	N/A
Ex-USA revenues	30%	28%	41%	DT

While Datadog’s net retention rate has since fallen to “120%-plus,” the other metrics point to Datadog being the better of the three options. The reason we’re not holding Datadog is because that wasn’t an option back when we invested in Splunk. Now, we’re given a good opportunity to swap Splunk out with Datadog.

Perhaps the bigger question would be whether we want continued exposure to the APM/SIEM theme. Will Cisco’s ownership of Splunk create some growth synergies, ways to steal market share from “smaller” players like Datadog? Maybe, but what could also happen is that Cisco could smother Splunk with bureaucracy and operate the business less effectively. We don’t know if the synergies will be 2+2=5 or 2+2=3, so maybe we can look at the total addressable market (TAM) vs. what’s been captured by leading players. While Splunk thinks it’s a $100 billion opportunity, Dynatrace and Datadog claim $50 and $62 billion respectively. Calculating TAMs is always a best guess, so let’s error on the side of caution and assume $50 billion. If we take last year’s revenues for each of the five publicly traded APM stocks, we get about $8.5 billion.

Let’s call it $10 billion to pick up any stragglers, and that means about 20% of the opportunity has been captured. There’s a case to be made for investing in Datadog, but we want to make sure we’re paying a fair price.

Investing in Datadog

If we do nothing, then we stand to gain 6% on our position’s value today. Since we’re getting paid to do nothing, why not set an aggressive SVR target for Datadog and then see if it’s hit? To calculate what that might be, we can look at historical SVR values over the past five quarters.

Anything below 13 seems to be a reasonable valuation, and Datadog isn’t far from that number with an SVR of 14 today. Since valuations tend to move slowly, perhaps the next step would be to write a focused piece on Datadog in anticipation of possibly pulling the trigger on some shares at the right valuation. In the event of that happening, we’d exit Splunk in its entirety, then start a third of a position size in Datadog. As always, Nanalyze Premium annual subscribers will be alerted to any trades we make.

Conclusion

Pending M&A events are inherently unpredictable which is why Splunk’s return profile now represents something entirely different. What investors can be certain about is large acquisitions like this are well planned, and that the intrinsic value of what’s being acquired is likely fair and accurate, especially given approvals from both boards. Having to wait a year for what seems to be a likely outcome means we could consider substituting our Splunk holding with some similar exposure. Datadog seems to be a promising way to play the APM niche which still appears to have lots of growth remaining.