Cisco said it will acquire Splunk for $28 billion, or $157 a share, in a deal that will give the networking giant a big play in security, AI and observability.

On a conference call, CEO Chuck Robbins said the Splunk deal (statement, Cisco blog) will make Cisco one of the largest software companies. It also transforms Cisco by positioning the company in growth markets AI, security and observability. "The value of data only increases. That's why this deal makes sense," said Robbins. "Our combined capabilities will provide an end-to-end data platform."

Robbins added that the two companies product lines were complementary and provide "full observability for the entire IT stack." He added that Cisco has a big opportunity to expand into AI driven networks.

Splunk CEO Gary Steele will join Cisco's executive team and report to Robbins. “Uniting with Cisco represents the next phase of Splunk's growth journey," said Steele, adding that the two companies have compatible cultures and scale to invest and expand market reach.

Among the key details:

  • Splunk will add $4 billion in ARR to Cisco.
  • Cisco expects the deal to be cash flow positive and gross margin accretive in the first year after the close and non-GAAP accretive in the second year.
  • The deal won't impact Cisco's stock buyback or dividend program.
  • The acquisition is expected to close in the third quarter of calendar 2024.

Observability is becoming a hot space. For instance, New Relic recently went private in a deal valued at $6.5 billion.

"There's a natural synergy when you can handle threat detection and security with AI. That's what you get with Cisco and Splunk," said Constellation Research CEO Ray Wang. "Customers get better network security and Splunk gets a key home and Cisco has a better story that drives AI valuation."

Robbins said the combination of Cisco's security business and data flow from Splunk can enable the company to solve more enterprise issues. "We also think there's an opportunity to expand our global presence," said Robbins. Steele added that international expansion can also boost Splunk and expand go-to-market opportunities. Although the companies said there isn't much product overlap, Cisco does have its own observability platform in the same areas as Splunk. 

The combination of Cisco and Splunk may also help enterprises looking to improve incident response. In a recent research report, Constellation Research analyst Andy Thurai found that 57% of incident response teams have more issues than they can handle.

Here are the Constellation Research Shortlists where Splunk appears.

Constellation Research's take

Given Cisco's reach in the enterprise technology market, there are a bevy of analysts covering the company. Here's how team Constellation Research assessed the deal.

Andy Thurai, the Constellation Research analyst following AIOps and the observability markets, made the following takeaways:

  • The first thought that comes to mind is that this deal is a very natural fit. Cisco entered the observability race with their acquisition of AppDynamics and ThousandEyes and has been trying to build the full stack observability (FSO) platform for a while. Adding Splunk to this mix brings a true full-stack observability capabilities between APM, DEM, Logs, other observability capabilities, and SIEM, to add to their own network monitoring.
  • Given that there is very little product overlap, Cisco gets a big customer base and potential upsell opportunity. A big TAM expansion.
  • Cisco's XDR is well-established and has been around for a while. Adding Splunk SIEM to the mix, assuming the companies can integrate soon, will be a huge boost. It will be hard to integrate two big platforms with considerable technical debt built over the years.
  • Cisco is known for channel selling. It can push Splunk, and the FSO platform thru the channel when it is ready.
  • Some nervous customers are already reaching out and asking for opinions and strategies on what to do. The pricing strategy will be a mess for a while. Splunk has recently moved to mostly consumption-based pricing. Cisco needs to figure out how to integrate this pricing model with its model soon.
  • Though the deal rationale suggests taking advantage of AI, security, and observability, I don't see it as much in AI. I see the synergies in security and observability. Neither company is a leading player in applied AI in their solutions. Splunk is ahead of Cisco on that front, but both need to catch up.
  • Cisco took a while to integrate AppDynamics and ThousandEyes long after the acquisitions. I hope this integration goes easier. Splunk was already struggling with too many acquisitions with TruStar, TwinWave, Phantom Cyber, and Metafor, on the security side, and Flowmil, Rigor, Plumbr, SignalFX, Omnition, and VictorOps on the observability side. My advice would be to dump the smaller, not useful ones to concentrate on the bigger goal.
  • While the acquisition price seems high, this gives Cisco an opportunity to expand its TAM. The observability market is growing and if Cisco and Splunk can integrate their platforms soon they can win on observability. Overall, this deal is good for both companies.  

Constellation Research analyst Dion Hinchcliffe said enterprise buyers will be thinking about vendor consolidation and pricing:

"Cisco's acquisition of Splunk is a bold move with the potential to reshape a key new sector of the IT industry. While there is a good bit of skepticism about Cisco's ability to preserve Splunk's culture of innovation, its massive customer base and global reach will likely help Splunk achieve even greater growth. CIOs will be watching closely to see if Cisco can address their growing concerns about vendor consolidation, with resulting higher prices, and see if they deliver a successful outcome for both companies' customers."

Constellation Research analyst Doug Henschen said:

"Cisco tried to get into enterprise software and acquiring Composite Software a few years back and it didn't work out. Splunk/AppDynamics, in contrast, are closer fit to Cisco in being focused on network and log data analysis. not enterprise data integration like Composite (now part of TIBCO)."

Holger Mueller, Constellation Research analyst, added:

"Cisco has long time realzied its future canno tbe the network alone, this is the boldest move to understand what is happening in the network, and on the network. If executed right it will be a better and more vertically integrated Cisco than before, thus creating value for CxO." 

 

Business Research Themes

Data to Decisions, Tech Optimization

Roles

Chief Information Officer

Tags

Incident Management, Observability, Cisco Systems, Splunk