Datadog is a company that quietly appears every three months with earnings results that say: “Remember me?” We are looking to increase allocation to this LTBH position as this is a rare leader in the migration to the cloud and the observability that is required across increasingly complex architectures. If you want a simple thesis that you can share with your friends and family, it’s this: Datadog lets us directly participate in the growth of AWS, Azure and Google Cloud through a pureplay that cross-sells better than almost any other cloud company.

Product Overview:

Datadog’s management team was very early to address the issue of silos in a cloud-native environment. As systems moved from on-premise to the public cloud to include virtualized machines and containers, the number of applications to monitor grew. Virtualized machines create more data from many more applications. The next iteration of the cloud, which was containers, exponentially grew the number of applications. Now that there are serverless architectures where every function needs to be tracked individually – which means the complexity has grown yet again.

Here's a picture of what I mean:

Datadog is a company that solves the complexity associated with the cloud as the products are able to observe and monitor any environment no matter how large the tech stack scales.

The second thing to understand about Datadog is that it’s not only cloud native but it also works well in a multi-cloud environment. This means Datadog is downstream from Azure, AWS and Google Cloud – no matter who a customer goes with and at what percentages for the deployment. The fact that companies prefer to work with more than one cloud vendor is actually a driving force for Datadog as it’s observability and security products can scale across any deployment a customer chooses and is flexible if the customer makes changes down the line.

The trend of multi-cloud and hybrid cloud is only going to accelerate from here which we covered in detail in our Big Data and Analytics analysis. It’s worth a read if you haven’t read it yet.

The company uses the word “standardization” to describe how the multi-cloud trend is a main driver for Datadog. We covered this in our last analysis but it bears repeating here as to why multi-cloud and hybrid cloud are important drivers for Datadog and how standardization plays a key role.

Standardizing means interoperability between various cloud environments and integrated interfaces. This is especially important with multi-cloud or hybrid cloud where companies have more than one environment. This is becoming the new normal to prevent vendor lock-in. The word standardization/ standardize was mentioned 20 times on the Q2 Earnings Call, highlighting its importance to Datadog’s story going forward. If corporations continue to standardize on Datadog’s platform, then the company will continue to capture market share.

Here’s a quote from our previous analysis:

Since dealing with multiple cloud vendors quickly becomes cumbersome, there is a natural tendency to standardize in tech, especially with software. Moreover, cloud applications need to communicate, so having everything on one platform can make detecting and resolving issues less complex and costly. We believe that we are on the cusp of this standardization trend with cloud software vendors, with Datadog leading the way. We believe that Datadog is best positioned to benefit from both the rise in cloud usage and the standardization of cloud software.”Moreover, cloud applications need to communicate, so having everything on one platform can make detecting and resolving issues less complex and costly. We believe that we are on the cusp of this standardization trend with cloud software vendors, with Datadog leading the way. We believe that Datadog is best positioned to benefit from both the rise in cloud usage and the standardization of cloud software.”

Datadog eliminates the need to work with many different vendors and pulls the entire DevOpsSec stack into one platform. This not only breaks down silos in terms of the observability framework yet also breaks down silos within the company.

Infrastructure Monitoring

At the point that companies migrate to the cloud from on-premise servers, how they monitor their infrastructure fundamentally changes. On-premise servers have fixed IP addresses and there are static servers and virtualized machines. Once you move to the cloud, this changes as servers are spun-up in the cloud and are not on-site and components are hosted across many regions.

At the start, Datadog helped monitor the hardware in cloud-native environments, the operating systems, and the application servers. Infrastructure monitoring is essential if there is a problem with the functionality of a cloud-native company on the back-end. It offers tools, such as CPU utilization, to determine if there’s sufficient processing capacity, memory utilization to determine if there’s memory capacity, and storage use which indicates the amount of disk that the host is using to store files and other content.

The goal of infrastructure monitoring is to prevent or troubleshoot performance issues and to lower costs. We’ve covered in the Big Data and ML analysis here the costs associated with cloud environments and why this is coming under pressure with more companies choosing hybrid architectures, including a mix of cloud and on-premise servers.

Datadog set out to disrupt on-premise solutions that monitored servers and virtualized machines. This is called “host-centric.” The primary issues with former infrastructure monitoring tools are that they do not scale for the cloud and it creates silos between departments. In the cloud, infrastructure monitoring uses an API for cloud-based metrics. Datadog’s products also remove the need for Secure Shell, or SSH, to log onto remote servers. As architectures evolved to serverless, legacy monitoring tools were even more outdated as there isn’t a server to run the code and install a monitoring agent.

One key thing about Datadog is the company allows for metadata to be tagged on backend components for better monitoring. These tags inform alerts and visualization tools. The company tags both the zones and the applications. Unified tagging limits the need for reconfiguration as a company scales. This is one of Datadog’s core competencies and their unique method approach to tagging is what they launched with in 2010. This aggregates and contextualizes the data no matter where the data comes from.

Another main selling point to many of Datadog’s features is a unified platform rather than many disparate tools or vendors. This is how Datadog has disrupted its competitors and crept into larger addressable markets. The unified platform works across all environments – on-premise, hybrid and cloud – and spans infrastructure monitoring, application monitoring, log management, observability and now security. By being so strong in the area of observability, Datadog can knock down its competitors by cross-selling 13 products from the key critical piece in the stack, which is monitoring and observability. With 450 integrations, Datadog leaves little reason to leave the platform and the dashboard for other tools.

The unified platform for complex architectures is also partly why Datadog is able to lead its competitors in standardization. The dashboard also offers AI to help customers move through the dashboard by recommending the next monitoring step. Here’s a direct quote from an analyst on the call that sums up Datadog’s positioning:

“Congrats on the solid quarter as well for me. But Oli, you’re already bigger than all your near-term or nearest competitors growing faster than all of them by a couple of magnitude. You talked about enterprise standardization trend that led to your largest deal in the company’s history.”

Application Performance Monitoring

As discussed, the number of applications that need monitoring began to exponentially grow with virtualized machines and containers. Infrastructure monitoring is incomplete in these architectures without application performance monitoring to assure applications and websites run as expected with optimal speeds across mobile platforms, cloud-native infrastructures, virtualized and containerized servers. Distributed application environments can cause numerous bottlenecks and it can be challenging to figure where the bottleneck is coming from. Meanwhile, slow speeds can cause customer drop-off.

APM also assures that the application is performing as it should and backend processes are executing as they should, including transaction processing, and detects bug or errors in the application code.

APM performs the following functions:

Digital user experience monitoring: determines if there are errors or downtime that could lead to a loss of revenue
Transaction profiling: analyzes the transaction flow to isolate the cause
Code-level diagnostics: According to DZone, 43% of application performance issues come from code. Diagnostics help to identify the line of code or query causing the issue.
Deep-dive analysis: Looks beyond code at the server and application infrastructure for problems such as insufficient memory or long wait times
Infrastructure monitoring: similar to deep drive analysis, ideally infrastructure monitoring is part of the APM package to monitor slow network connections or virtualization bottlenecks.

Datadog’s APM also comes with network performance monitoring to verify if the network is slowing down traffic or if there is a low connectivity issue. The 360-degree view of infrastructure, applications and networks helps diagnose issues more quickly and with more accuracy.

According to Gartner, the number of applications monitored with APM tools has increased from 5% in 2018 to 20% in 2021. Machine learning is also used to forecast usage patterns and to detect anomalies outside of manual alerts.

Observability

Where observability differs from APM is that it monitors external data across metrics, events, logging and tracing (MELT). It’s called observability because it provides visibility as the issue is occurring and ideally before there is a performance issue.

Observability tools work with telemetry data, which is this combination of logs, metrics and traces. Metrics are numerical measurements, such a transactions per second. Events are individual actions. Logs are application-specific structured and unstructured data. Tracing tracks how many requests flow through a system. This is achieved through APIs, such as the Tracer API or the Metric API.

An observability framework allows you to work with telemetry data with fast retrieval and good visualization. In this specific area, Datadog competes yet is also compatible with the open-source framework called OpenTelemetry. You could also argue the project erodes some of Datadog’s moat as it reduces vendor lock-in but it’s the end-to-end tools that draws customers to Datadog rather than only the telemetry data. We covered this here in Q2.

Because Datadog is an end-to-end tool, it can be compatible with OpenTelemetry by allowing the open-sourced SDK to connect to the platform for telemetry data. The company also supports other open-source projects under the OpenTelemetry umbrella, such as OpenTracing, OpenCensus and OpenMetrics. This has created a standard set of APIs and libraries for observability and allows for the telemetry data to be easily migrated between vendors. Datadog has contributed to the project with its auto-instrumentation libraries.

Kubernetes and the rise of microservice-based architectures increase application reliability and efficiency; however, developers need the ability to monitor these architectures. Microservices benefit from Observability as it helps understand how microservices communicate. This keeps track of metadata for performance purposes and also distributed traces or requests. Observability allows for a more holistic picture so developers can connect data to monitoring tools and solve issues quickly.

Datadog has a new product that offers observability before code goes to production called CI Visibility. The launch of the CI Visibility product follows the acquisition of Undefined Labs. Datadog talks about “shifting left” which means moving more into the development phase prior to production.

Continuous integration and continuous delivery (CI/CD) provide a shared repository of code for an automated build process with regular intervals. This helps speed up development by deploying smaller batches of code. In data science machine learning models, projects are based on code and also the data used to train the model. The CI/CD data pipelines help to deliver machine learning models and this is another opportunity for Datadog’s observability tools to serve a growing demand.

Security Platform

Datadog’s core product is observability and security is an additional catalyst (or an accelerant). Datadog’s positioning with observability puts the products into the right place in the tech stack for threat detection. Cloud environments have an increased attack surface across infrastructure, containers and applications. As teams seek simplified operations, there are more third-party managed services being deployed which reduces visibility. Datadog offers a few security products to allow teams to detect real-time threats to applications and infrastructure, track compliance posture, and also workload security across infrastructure or workloads, such as Kubernetes clusters. With security monitoring, engineering teams have end-to-end analytics coverage from a unified dashboard. This increases time to resolution and also means you can find threats buried deep in the architecture.

As we covered in our previous write-up, the Sqreen acquisition helps Datadog take advantage of the trend towards microservices and Kubernetes rather than monolithic architectures. Generally speaking, Kubernetes can introduce vulnerable clusters due to default configurations. In the past, demonstrations at BlackHat, the annual security conference held in Las Vegas, have exploited features in Kubernetes default attack surface rather than bugs. Sqreen specializes in protecting code-level risks across distributed applications by protecting application logic. Sqreen’s main goal is to deliver security solutions to developers and the operations teams, as well, i.e., to “democratize” and emphasize security testing and implementation during the development process, often called DevSecOps. These are the two main points on this acquisition – more market share across security for microservices and more stakeholders at a company who can buy and deploy Datadog products outside of the security team.

The breakdown between developers, operations and security called DevSecOps is a transition that Datadog plans to capture similar to how the company captured DevOps. Applications and infrastructure security is new to Datadog yet management has hinted towards it becoming as big as the observability market, which is at $38 billion in 2021.

Datadog’s Financials

Datadog accelerated revenue growth during a year of tough covid comps. This shows remarkable product strength. The company’s revenue is up 75% year-over-year to $270 million, an acceleration from 66.81% last quarter, and 61.35% revenue growth in the year-ago quarter. The revenue comfortably beat estimates by 10% and was up 16% QoQ.

The company has an adjusted operating margin of 16% and adjusted EPS of $0.13. The company also had free cash flow of $57.1 million which is an increase from last quarter’s $52 million. This proves the company can grow the top line and invest heavily in R&D but not at the expense of the bottom line. The company has $1.5 billion in cash and cash equivalents.

The company issued guidance of $291 million in revenue, or 52.3% growth in the fourth quarter and EPS of $0.11. For the full year, the company is guiding for $994 million, at the midpoint, and adjusted EPS of $0.39-$0.40. According to the company, usage is down for them seasonally in Q4 as employees and businesses take holiday breaks.

It’s the underlying key metrics on customer growth that help forecast strength for Datadog as we move into 2022. The company has 17,500 total customers of which 1,800 have a ARR of $100K or more, up 66%. These accounts make up 80% of ARR, so growth in the <$100K segment is key. The other key driver of growth for Datadog is the cross-selling of products. The company is unusually strong here with 77% of customers using two or more products, up from 71% a year ago. The number of customers who use four or more products is at 31%, up from 20% a year-ago. The company also stated that net dollar retention rate is above 130 for the 17th consecutive quarter.

Annual recurring revenue helps gauge what level of revenue a company is expecting. According to management, “We also had a record quarter of ARR adds, including record ARR adds in all of our major products. And we saw strong growth across geographical regions, with all regions accelerated on a year-over-year basis compared to Q2.”

Although billings contract terms have fluctuated due to Covid with shorter terms in 2020 that are slowly returning to a more normal length. This helped drive Billings growth of 98% year-over-year. Increased contract duration to annual and multi-year partly contributed to remaining performance obligations (RPO) growth of 127%. On a more normalized basis, the company mentioned current RPO growth was closer to 100%. Revenue still remains the primary way to value Datadog, however, this under-the-hood growth certainly helps understand the strength of the company and how customers view the products as we move into 2022.

The company is investing “significantly in R&D” and plans to spend on travel and conferences in the coming year. The R&D expenses were up 80% in Q3 which management explained by saying, “It’s important to go fast when scaling those teams because there’s quite a bit of a lead time between the time when you hire engineers and the time when you get new products on the other hand. I’ve mentioned in other calls like maybe hiring now is a good predictor of output two years from now on the engineering side. So we should get started. That’s why we’re doing it.”

Notably, we like companies that invest in their engineering teams. Datadog points towards pricing power and cross-selling as to why they’re able to invest heavily in R&D and still remain profitable.

Conclusion:

As someone had said on the forum following the stellar earnings report: “Who let the Dog out?!”

To be literal, it’s AWS, Azure and Google Cloud that let the dog out. Our simplified thesis as we rounded the corner into tough Q2 covid comps was specifically, “If the tech giants are communicating that cloud infrastructure-as-a-service is one of the most critical markets in the future, then who are we to argue with this by not investing in the leader across cloud monitoring products?”

Observability is not exactly the most conversational topic, but hopefully it’s understood that architectures are becoming more complex in terms of monitoring and observability. I’m also hoping it’s clear from this analysis that Datadog has additional tailwinds from the trend towards hybrid and multi-cloud. Lastly, the management has not only executed before, during, and after Covid, yet has also grown its product suite to leverage its key positioning at the observability layer. Many companies will begin here and remain with Datadog for other products.

Valuation is high at 43X forward P/S. We rarely buy above 50 forward P/S and much prefer under 40. However, you’ll get buy alerts as we go along to help communicate when the risk/reward looks favorable as we continue to build this position.

Splunk Inc’s (NASDAQ: SPLK) shares are currently trading at $118.46 which represents flat gains over the past 12-months basis compared to the broader market returning flat gains over the same time frame. Second-quarter earnings were reported on Wednesday and the question of weakening cash flow is taking center stage.

Splunk Overview

Splunk is a hybrid cloud computing company that harnesses the power of artificial intelligence to offer data analytics solutions to a variety of organizations. The company is one of the leaders in the big data analysis and security space, which according to Statista is expected to grow from roughly $42 billion in 2018 to $103 billion by 2027 representing a CAGR of 9.4 percent.

The company derives the majority of its revenue from licensing its platform which gives users the ability to investigate, monitor, analyze and act on machine data regardless of format or source. “Machine data is produced by nearly every software application and electronic device across an organization and contains a real-time record of various activities, such as transactions, customer and user behavior, and security threats,” Splunk notes in its annual report.

Splunk offers customers two options; either Splunk Enterprise whose license fee is based on the estimated daily data indexing capacity required and Splunk Cloud which offers the core capabilities of Splunk Enterprise as a scalable cloud service.

Splunk’s Q2 Highlights

Ultimately, the most important aspect that potential shareholders were looking for was whether Splunk would be able to improve its cash flow going forward. Back in May when the company released its first-quarter earnings report, the share price tumbled by at least 17 percent driven by concerns about the company’s weakening cash flow.

History seemed to repeat itself again on Wednesday when shares fell over 10 percent after it reported earnings. Apparently, the market chose to ignore the fact that Splunk had another one of its best quarters in recent years and that it had made significant progress towards shifting its business model from perpetual software licenses to recurrent cloud-based revenue.

As a matter of fact, Splunk reported better than expected numbers in the quarter, and also reaffirmed guidance for the rest of the year. According to the earnings release, the new business model is already paying off with revenue for the second quarter posting a 33 percent increase to $517 million compared to the year ago quarter. Software revenues, which combines licensing and cloud, were up $350 million or 46 percent year-over-year.

Moreover, the company added more than 500 new Enterprise customers including Verizon Media Group and ABB Group, in addition to recording 93 orders greater than $1 million. In spite of this, the company still posted an operating loss of $100.9 million, though adjusted earnings came in at $0.30 per share which beat Wall Street’s expectations of $0.12 on revenue of $488.4 million.

Overall, gross margin for the quarter was 84 percent up 2 points on a year-over-year basis with cloud delivering over 50 percent gross margin.

In Q2, 95 percent of software revenue was either term or cloud and management expects the elimination of perpetual license sales will accelerate the renewable mix to 99 percent in Q4 and high 90s for the full year.

As previously highlighted in Q1, the accelerated shift to renewable has a timing impact on cash collections. In other words, Splunk’s transition from perpetual licenses to more predictable, cloud-based subscription model is happening much faster than the company initially anticipated and this has caused the timing of Splunk’s cash flow to take a hit over the short term.

Newly appointed CFO Jason Child had this to say about the cash flow situation:

“As expected, Q2 operating cash flow was negative, given the more rapid growth of multi-year term and cloud contracts. This translates to a greater cash flow drag this year, as more of our contracts are paid ratably. We are now expecting negative operating cash flow for the balance of the current year and expect fiscal 2020 with $300 million net negative operating cash flow.”

This is in stark contrast to the Q1 cash flow guidance of positive $250 million which understandably spooked investors triggering a mild sell off.

According to Child, there were two new drivers behind this expected reduction. First, the renewable transformation is already essentially complete with the mix at 95 percent in Q2 and expected to go to 99 percent by Q4. Second, the company is significantly reducing its upfront cash invoicing for term and cloud deals from 58 percent paid upfront in the first half of FY 2020 to an estimated 33 percent paid upfront in the second half of FY 2020.

William Blair analyst David Griffin further explains that “because the entire value of perpetual contracts is invoiced and collected in cash up front, the lower contribution creates a significant headwind to cash flow.” The company is also billing customers for fewer months in advance, which again reduces cash received up front.

Apart from transitioning away from perpetual licenses, Splunk has made some strategic purchases in the recent past to boost its artificial intelligence position, including SignalSense in 2017 and VictorOps last year. On the call, Splunk revealed that it would be making another acquisition – cloud-monitoring service SignalFX for $1.05 billion in a cash-and-stock deal which is expected to strengthen the company’s application monitoring service.

The combination of Splunk and SignalFx will give application developers and IT departments a unified data platform that allows them to monitor and absorb data in real-time, no matter the infrastructure or scale, in order to cut costs, boost revenue and improve the customer experience. “I am excited by our strong quarter, tremendous cloud growth and our agreement to acquire SignalFx,” Splunk CEO Doug Merritt said during the earnings call. “I am particularly pleased with how quickly we are accelerating our business transformation to cloud, and the impact cloud is having on our customers.”

Splunk’s Valuation

A quick look at Splunk’s revenue multiples shows that it is trading well below its three-year historical price to sales ratio. Furthermore, on a relative valuation basis, Splunk doesn’t appear to be as expensive as other companies in a similar space. The chart below shows the price to sales ratios for Splunk versus Adobe (NASDAQ: ADBE), Talend (NASDAQ: TLND), Salesforce (NASDAQ: CRM), Workday (NASDAQ: WDAY).

(Source: YCharts)

With the company expecting total revenues of approximately $2.25 billion in 2020, this would imply a forward price to sales of roughly 7x which would make it a bargain compared to other companies in the same sector.

Conclusion

Splunk has delivered revenue figures above analysts’ forecasts in the past 12 consecutive quarters. The main takeaway is that the transition of the business model is just about completed and any near-term weakness should be watched closely for a potential buying opportunity. Acquisitions, like Salesforce and Tableau, and Google and Looker, are shaking up the space and this may have also affected buying pressure.

Disclosure: Disclosure: Subscribers to my premium service may have positions in the securities mentioned in this article or may take positions at any time. Splunk is not currently on my list of top tech stocks although this may change in the future.

Category: Data Analytics

Datadog Deep Dive: Rare Pure Play with Cloud IaaS Tailwinds