Datadog (DDOG) Stock Q1 2020 Earnings Results Review

Datadog released their Q1 2020 earnings report on May 11. The company delivered their typical beat and raise, exhibiting no noticeable slowdown from COVID-19. The market rewarded the stock the next day with a 24% jump, on top of a 47% run-up previously in 2020. Unlike other software companies impacted by COVID-19, Datadog kept annual guidance and even raised revenue targets by 5% over their prior estimate. Analysts and management were upbeat on the earnings call – price targets were raised across the board. In this post, I will review Datadog’s earnings results and then examine the broader observability space, as several competitors announced earnings recently as well.

Headline Financial Results (EPS is Non-GAAP)

• Q1 2020 Revenue was $131M, up 87% year/year. This compares to the consensus estimate of $117.7M, representing growth of about 68%, and the company’s guidance from Q4 of a range of $117-119M. Datadog beat by almost 20% in annualized revenue growth. Q4 2019 revenue growth was 84.4%.
• Q1 EPS was $0.06 vs. ($0.02) expected, representing a beat of $0.08. This compares to ($0.09) in Q1 2019. The company’s original EPS guidance from Q4 earnings was a range of ($0.07) to ($0.03).
• Q1 Non-GAAP operating income was $16.1M, representing an operating margin of 12.3%. This compares to an operating loss of $7.0M in Q1 2019, representing an operating margin of -10%. Q4 operating margin was 6.1%.
• Q1 FCF was $19.3M, representing a FCF margin of 14.7%. Q4 FCF margin was 9.6% and in Q1 2019, it was -1%.
• Q2 2020 Revenue estimate of $134-136M, representing growth of 62% year/year. This compares to consensus revenue estimate of $126.3M, or 52% growth. The raise was about 10% of annualized growth.
• Q2 2020 EPS estimate of $0.00 – $0.01 vs. ($0.02) expected, representing a raise of about $0.03.
• Q2 estimated Non-GAAP operating income of ($1M) – $1M, for an operating margin of 0% at the midpoint.
• FY 2020 Revenue estimate of $555-565M, representing growth of 54.3% over FY 2019 at the midpoint. This compares to consensus revenue estimate of $534.5M, representing growth of 47.3%, and prior company guidance from Q4 of $535-545M.
• FY 2020 EPS estimate of $0.02 – $0.06 versus vs ($0.06), representing a raise of $0.10 at the midpoint. Guidance from Q4 for FY 2020 EPS was ($0.07) to ($0.03).
• FY 2020 estimated Non-GAAP operating income of $0M to $10M for an operating margin of 1% at the midpoint.
• Ended the quarter with cash, cash equivalents and marketable securities of $798.5M.

Other Performance Indicators

• Q1 billings were $137.9 million, up 55% year-over-year. Management noted that some customers asked for shorter billing durations, due to COVID-19. The impact of this on the quarter was approximately $10M in billings. Normalizing for this and a separate one-time customer billing timing change, billings would have grown 70% year/year.
• Total RPO was $256M at quarter’s end and grew 82% year/year.
• Q1 Non-GAAP gross margin of 80% versus 78% in Q4 and 73% in Q1 2019. Improvement in gross margin was driven by efficient use of cloud hosting.
• Breaking down Q1 Non-GAAP expenses by category, we see year/year reductions in relative percentage of revenue across all three. Management commented on the call that they are increasing spend in these areas, but revenue outperformance is greater. This reflects an operating model with positive leverage.
  • R&D = 27% (versus 31% in Q1 2019)
  • S&M = 32% (41% in Q1 2019)
  • G&A = 9% (10% in Q1 2019)
• Customer growth was strong, with 960 customers at end of Q1 with greater than $100k ARR, versus 508 in the year ago period. This represents growth of 89%. Customers with spend over $100k make up 75% of ARR. Less than 15% of revenue comes from customers with 100 or less employees.
• Ended the quarter with about 11,500 total customers, which is about 40% higher than the 8,200 customer count in the year ago period. Added almost 1,000 net new customers in Q1, which is twice the number added in the same period last year.
• Dollar-based net retention rate was over 130%, consistent with the past 11 quarters.
• Product announcements in the quarter:
  • Released Security Monitoring to general availability. This product is directed at security operations teams, with the intent to break down the silos between SecOps, Development and TechOps teams. The CEO remarked that Security Monitoring was their most demanded product beta in company history.
  • Surpassed 400 third party system integrations. The breadth of Datadog’s integrations is significant and compares well to competitors. Maximizing integrations ensures high customer adoption (can accommodate all edge cases) and exposes the Datadog platform to the broadest set of data (network effects).
  • Extended Watchdog, the machine learning based auto-detection engine, to additional infrastructure use cases in order to automatically surface anomalies, as well as enabling it to pinpoint patterns of errors in application traces.
  • Extended the Network Performance Monitoring (NPM) product, to provide visibility into network flows across production installations.
  • Enhanced Serverless monitoring capabilities, to provide further visibility and debugging for functions through more granular metadata, collected in real-time. Achieved the AWS Lambda Ready designation, demonstrating Datadog’s deep integration with AWS Lambda.
  • Received ISO 27001, 27017 and 27018 certification. The ISO 27000 family of standards are a widely recognized international set of guidelines detailing best practices for the management of information security and privacy.
  • Announced integration with Nessus to include vulnerability assessment data as part of the overall Datadog security monitoring solution. Also, completed integration with VMware Carbon Black.

• At end of Q1, approximately 63% of customers were using more than one Datadog product, up from 58% in Q4 and 32% a year earlier. This illustrates strong uptake of new product offerings. As investors will recall, Datadog started with infrastructure monitoring, then added APM in 2017, logs in 2018, user experience and network performance monitoring in 2019, and security monitoring in April 2020. They now have seven individual product SKUs, more than half of which were added in the last year.
• Approximately 75% of new customers landed with two or more products.
• Customer highlights from the earnings call:
  • New 7-figure win from a Fortune 100 pharmaceutical company, starting their migration to a container-based hybrid cloud. Mentioned that the incumbent legacy tool didn’t keep up with the requirements of the customer’s new dynamic stack.
  • Signed a 6-figure new logo deal to provide monitoring for a large health insurance company, to support a multi-cloud deployment. Was won through a new partnership with one of the world’s largest system integrators. This provides a good example of success after Datadog announced their Partner Network in January.
  • Sizable upsell to a mid-market on-demand logistics company which now spends more than $1M a year. This company had been a Datadog customer since 2018, starting with infrastructure monitoring and then adopted both APM and log management in 2019. Today, this customer is using Synthetics, NPM and most recently, Security Monitoring. The customer partnered with Datadog directly to build out the security product and has quickly found value in scanning logs to detect security threats.
  • Major 6-figure upsell to one of the world’s largest global financial institutions. This customer plans to migrate thousands of applications over the coming years, with Datadog being the standard across multiple public and private clouds. This customer has extremely stringent security requirements and is using the new serverless monitoring capabilities.

• Only 24% of business comes from customers with a billing address outside of North America. Datadog is investing heavily in a go-to-market strategy to grow their international business.
• On the earnings call, the CEO emphasized that Datadog will be continuing to invest aggressively to pursue the large opportunity ahead of them. This spans both R&D and the go-to-market team. R&D spend will be focused on continuing to extend existing products and launch new ones. They are also opportunistically hiring engineering talent while it is newly available on the market (perhaps from other digital-first companies that cut back recently, like Airbnb and Uber). Datadog is applying a similar hiring approach to sales and marketing to keep attracting new customers.
• Regarding future product releases, Datadog management was a little guarded. The CEO said that recently released products like APM and Logging are still in high growth mode, as well as Synthetics and RUM. These require heavy investment to maintain and keep ahead of competitive offerings. Also, mentioned that the Security product has a long road map. He did discuss some skunkworks projects around new offerings that take monitored data and apply actions, but nothing to announce.
• CEO gave some more color around competitive technology displacement for new deals. He said that Datadog usually doesn’t replace the tools that customers are using to monitor their on-prem infrastructure. Datadog is typically brought in to provide monitoring to the workloads being moved onto the cloud. So, it is new cloud development projects that are creating the description of many new deals as “greenfield”. He also mentioned that many customers are still early in their cloud migration, citing a metric of as little as 5-10% application monitoring coverage within enterprises currently.

Analyst Reactions

Following Datadog’s Q1 earnings, 11 sell-side analysts provided updated coverage ratings. Of the analysts providing updated ratings, all raised their price targets. Seven rated the stock at a buy equivalent and four gave a neutral rating. The average price target for these updates is $63.73, representing a 8% reduction from the closing price of $68.86 on May 12th.

Date	Analyst	Rating	Price Target
5/12	JP Morgan	Overweight	Raised from $60 to $65
5/12	Morgan Stanley	Equal Weight	Raised from $42 to $60
5/12	Rosenblatt	Buy	Raised from $61 to $75
5/12	Needham	Buy	Raised from $58 to $70
5/12	Barclays	Overweight	Raised from $42 to $70
5/12	Credit Suisse	Neutral	Raised from $45 to $55
5/12	Mizuho	Buy	Raised from $46 to $66
5/12	Stifel	Buy	Raised from $50 to $60
5/12	Jeffries	Hold	Raised from $39 to $59
5/12	Goldman Sachs	Buy	Raised from $47 to $66
5/12	RBC	Sector Perform	Raised from $43 to $55

After the earnings results, Barclays set one of the highest price targets, raising from $42 to $70. Analyst Raimo Lenschow provided this commentary.

Barclays analyst Raimo Lenschow raised the firm’s price target on Datadog to $70 from $42 and keeps an Overweight rating on the shares. The company last night delivered strong Q1 results, guided above Street for Q2, and raised fiscal year guidance, Lenschow tells investors in a research note. He believes the results demonstrate Datadog’s strong momentum in capturing the monitoring workloads of customers’ cloud migrations to Azure, Google and Amazon Web Services. The analyst continues to see Datadog as a “great way to capture the multi-year cloud migration opportunity.”

TheFly.com, May 12, 2020

Jeffries maintained a Hold rating, raising their price target from $39 to $59. Analyst Brent Thill provided the following commentary.

Jefferies analyst Brent Thill raised the firm’s price target on Datadog to $59 from $39 and keeps a Hold rating on the shares. The company last night reported “fantastic” results, including revenue performance obligation growth of 82% year-over-year, driven in part by lengthening contract durations, suggesting growing platform commitment, Thill tells investors in a research note. The surge of usage amid COVID speaks to “criticality of the solution set in delivering the promise of the cloud,” adds the analyst. Thill, however, waits for a pullback in Datadog shares before recommending the name.

TheFly.com, May 12, 2020

Observability Market Activity

The competitive dynamics of the observability market are continuously shifting. Based on overall growth rates and consolidation of observability use cases into a single platform, Datadog still occupies the pole position. While there are several competitive offerings, Datadog claims that most of their new customer wins are greenfield opportunities, where they are not displacing a commercial product. In these cases, the enterprise is embarking on the cloud migration process and needs a cloud-based monitoring solution for their first cloud-hosted apps. Datadog often wins this initial business with a small footprint. The buyer in these cases can be a lower level manager, who just needs to get a monitoring solution in place. This reflects Datadog’s bottom-up sales approach. Over time, the customer will increase usage as they migrate more apps to the cloud and realize the power and flexibility of the Datadog solution set. The customer will also expand to other Datadog products. For example, they might start with infrastructure monitoring for their new cloud tier, then add APM, logging, synthetics, network, etc., as they become more sophisticated. For monitoring their on-prem systems, the enterprise will usually maintain their open source legacy solution.

Coverage metrics are surprisingly low for observability at enterprises in general. Datadog, Dynatrace and industry analysts cite monitoring tool coverage rates as low as 5-10% of application footprint at most enterprises. While not every software application needs sophisticated monitoring, we can assume that this coverage percentage will increase substantially from current levels. I was surprised to hear this metric, as every internet-first company I have seen already has one of the commercial monitoring solutions in place. However, I can appreciate the argument that more traditional global 2000 enterprises would not.

The next big opportunity for Datadog is the addition of security. The reason this is important is that many maturing IT organizations are realizing that their Security Operations team is isolated from the main technology team. SecOps often has their own toolsets for monitoring infrastructure activity that are separate from the tools used by DevOps for observability. This can generate redundant costs and different views of activity. Also, the separate SecOps toolset creates an additional dependency on the DevOps team, who has to apply distinct agent/monitoring configurations for the SecOps tools to work. Since DevOps doesn’t use these tools, it is easy to forget about these needs as they are constantly updating network and infrastructure configurations. By expanding into security, Datadog is consolidating these toolsets and allowing SecOps and DevOps to work more closely together. This seems to be a direction that many enterprises are moving. Given this, a commercial observability platform that is lacking a robust security monitoring capability will increasingly be at a disadvantage.

As we look for other product opportunities beyond observability for Datadog, I can see IT operations management as a next logical step. If observability is collecting data about the availability of applications, it would make sense to leverage insights, history and common patterns to take action on issues observed. This could be in the form of communicating and managing alerts, or proactively reconfiguring the infrastructure to mitigate the impact of the issue. Incident management is a service offered by Splunk, through their VictorOps acquisition, as well as PagerDuty (PD). This could represent a future product expansion opportunity for Datadog. At an analyst event after earnings, the CEO also hinted at product offerings that might precede production, like release management or code audits. Events from production activity might yield insights that could be applied to upcoming CI/CD flows.

Several of Datadog’s competitors in the observability space reported earnings after Datadog. We can gain insight into overall market dynamics by examining the financial performance and product development direction for each of the major players. Let’s take a look at Dynatrace (DT), New Relic (NEWR) and Splunk (SPLK).

Dynatrace (DT)

Dynatrace reported Q4 2020 earnings results on May 12 before the market opened. They beat expectations for for the prior quarter and issued inline forward guidance for the current quarter. Full year guidance was above expectations on earnings and below for revenue. They attributed this to COVID-19 impact on some customers. The market reacted negatively to the results, pushing the stock down 3.3% that day. Since then, it has recouped the loss and moved back towards its ATH price.

• Q4 2020 Revenue was $150.6M, up 29.6% year/year. This compares to consensus estimate for $146.3M.
• Q4 EPS was $0.11 vs. $0.08 expected, representing a beat of $0.03.
• Q4 Non-GAAP operating income of $36M, representing an operating margin of 24%.
• Q4 FCF of $63.3M, representing a FCF margin of 42%.
• Q1 FY2021 Revenue estimate of $148-150M vs. $149.5M consensus. This calls for 24.5% year/year growth at the midpoint.
• Q1 FY2021 EPS estimate of $0.09-0.10 vs. $0.07 consensus.
• Q1 FY2021 Non-GAAP operating income of $38-40M, representing an operating margin target of 26.2%.
• FY2021 Revenue estimate of $630-643M vs. $650.1 consensus. This calls for 17-20% year/year growth.
• FY2021 ARR guidance is $680 million to $692 million, for 19% to 21% growth.
• FY2021 EPS of $0.39-0.42 vs. $0.33 consensus.
• FY2021 Non-GAAP operating income of $146.0M to $156.0M, representing an operating margin of 23.7% at the midpoint.
• FY2021 FCF in the range of $180-190M for a FCF margin of 29.1%.

• Q4 2020 gross margin was 83%.
• Q4 Subscription and Services revenue of $148.3M, representing a year-over-year increase of 37%.
• ARR of $572.8M at end of Q4, representing a year/year increase of 42%. Dynatrace leadership considers this metric to be the most important measure of growth. The two drivers of ARR growth are new customer lands and the net expansion rate. 
• RPO was approximately $860M at end of Q4, an increase of 56% over Q4 of last year.
• Ended Q4 with 2,373 customers, an increase of 1,009 customers year/year, up 74%. Q4 customer adds were 165 or 7.5% sequentially. Focus is on larger enterprise customers.
• Net Expansion Rate of 123%, the 8th consecutive quarter at or above 120%. Although for FY2021, management expects NER to drop to 115%.
• Named a leader for completeness of vision and ability to execute in the Gartner Magic Quadrant for APM for the 10th consecutive time and simultaneously earned the highest scores for 5 of 6 critical capabilities in the Gartner Critical Capabilities report for APM.
• Announced the release of their latest version of infrastructure observability, which includes major enhancements to AI, log monitoring and data source access. These should bring greater automation and efficiency to a wider multi-cloud landscape. Their infrastructure-only offering is now used by 29% of the customer base. Dynatrace’s infrastructure-only module includes log monitoring, network monitoring, and AIOps. 
• Expanded their explainable AI engine, Davis, to process business KPIs, such as revenue trends, customer conversions and churn. In addition, Dynatrace now enables one-click integration with the most popular web analytics solutions, like Adobe Analytics. These enhancements facilitate automatic detection of the root-cause of business impacting anomalies.
• Broadened their digital experience offering with new mobile platform and framework support for native mobile applications. Made it very easy to instrument native mobile apps to support digital experience insights. CEO mentioned they have seen a surge in demand for mobile monitoring.
• Announced “In Process” status to attain FedRAMP authorization at a moderate impact level.
• Investors should note that Dynatrace’s product packaging is different than Datadog’s. Their full stack APM module includes both infrastructure monitoring and AIOps. The infrastructure-only module includes log monitoring, network monitoring and AIOps. Management thinks this packaging is a competitive advantage. “Rather than fragment our offering into a list of tools, we take a more holistic approach and solve by use case going after a larger problem set to drive greater simplicity, efficiency, and value for our customers.”
• Over the past year, Dynatrace has gone from approximately 15% of customers buying three or more modules to over 25%. This provides evidence of a strong cross-selling motion, like we see with Datadog.
• Management expects to modestly grow headcount in Q1-Q2 as they evaluate the impact of the COVID-19 situation. Expect to re-accelerate hiring in second half of year.

Dynatrace Take-aways

• In the investor slide deck, management called out their recent entry into analytics and business intelligence, which they claim expands their TAM by another $24B. This is one area where Dynatrace is trying to differentiate their product positioning.
• Customer growth year/year is rapid (74%) and on par with Datadog (89% for >$100k ARR, 40% overall). This is with Dynatrace’s focus on large, traditional “blue chip” companies. On the earnings call, management stated that they focus on “the top 15,000 largest enterprises around the world.” The customer set is impressive. While the market opportunity is described as greenfield by Datadog, Dynatrace might be quickly closing the gap on the largest enterprises.

• Dynatrace has strong profitability metrics. Free cash flow and operating margins are much higher than other companies.
• In terms of their perception of competitive position, Dynatrace feels they excel in two areas – support for multi-cloud deployments through distributed tracing and strong capabilities in automation and AI to generate proactive insights for taking action. They place heavy emphasis on AIOps, where AI automatically identifies service-impacting issues at time of degradation and provides actionable insights for rapid remediation. DT feels that with increasingly complex hosting environments, mixing cloud, on-prem and hybrid environments, only an AI-assisted observability solution can allow humans to understand what is happening. They think that as the application footprint expands for enterprises to monitor, they will rely on more intelligence and automation in order to keep their DevOps team size manageable. This point was underscored in a CIO survey that Dynatrace conducted in Jan 2020.

• Dynatrace claims a strong land and expand model as well. They cite an initial land of $94k ARR on average, which will expand to $220k ARR for long-term customers.
• Have well established relationships with VARs, SIs and MSPs. Their Partner Network seems more mature than Datadog’s.
• Compared to Datadog, Dynatrace has no security offering currently. They seem more focused on future product extensions into business analytics and customer experience monitoring.

New Relic (NEWR)

New Relic reported Q4 FY2020 earnings results on May 14. They beat expectations for the past quarter and issued forward guidance that was slightly below expectations on revenue and significantly below on EPS. They did not provide guidance for the current fiscal year. The market reacted positively the next day, with the stock gaining 9.6%. This was probably a result of lowered expectations, as NEWR traded 43% below its ATH prior to the earnings report.

• Q4 2020 Revenue was $159.7M, up 20.9% year/year. This compares to consensus estimate for $154.0M.
• Q4 EPS was $0.14 vs. $0.03 expected, representing a beat of $0.11.
• Q4 Non-GAAP operating income of $3.5M, representing an operating margin of 2.2%.
• Q4 FCF was $51.1M, representing a FCF margin of 32%.
• Q1 FY2021 Revenue of $158-160M vs. $160.9M consensus. This translates to 12-13% year/year growth at the midpoint.
• Q1 FY2021 EPS of $(0.01)-0.04, versus $0.09 consensus.
• Q1 FY2021 Non-GAAP operating income of between $(3)M and $0.
• Q1 ARR growth of 13% to 14%, year-over-year.
• Did not provide full year FY2021 guidance.

• Q4 2020 gross margin was 84%.
• Total ARR of $636M at end of Q4, representing growth of 16.6% year/year.
• Had 993 customers with >$100k spend in Q4, compared to 858 a year ago, representing growth of about 16% annually. Added 67 in Q4, up from 926.
• Customers spending >$100k in ARR made up 75% of total ARR, versus 70% a year ago.
• DBNER for for Q4 of 116%, compared to 131% in Q4 of FY2019. This is up from 109% in the prior quarter.
• Total paid business accounts declined to approximately 16,300, down from 17,000 at the end of FY19.
• Average ARR from paid business accounts > $100K increased to $481K, up from $443K at the end of FY19. 
• Paid business accounts with ARR > $1M increased to 95, up from 72 at the end of FY19
• Achieved FedRAMP authorization at a moderate impact level.
• Delivered enhanced AIOps capabilities. New Relic’s AI solution reduces alert quantity by identifying infrastructure alerts that appear common and consolidating them into one. It also tries to proactively examine anomalies and predict production issues before they become outages. Management claims that some customers have seen an 80% reduction in alert noise. This results in headcount savings, by not requiring as much staff to respond to alerts and troubleshoot them. New AI capabilities came out of the SignifAI acquisition from early 2019.
• Introduced a distributed tracing solution, New Relic Edge with Infinite Tracing. This solution is targeted at APM for microservices and containers. It can capture the slowest transactions and application errors as they flow through a multi-tiered environment. They claim it does not require the customer to install a software agent in their environment.
• Continued work on the New Relic One platform. Delivered new logging, serverless and programmability capabilities.
• Management plans to continue hiring in both R&D and sales at the same pace through the upcoming year.

New Relic Take-Aways

• If Dynatrace is trying to distinguish themselves through a focus on AI and automation, New Relic is focusing on programmability. They recently launched their New Relic One platform, which allows DevOps teams to build customized views of monitored data. These are compiled into “apps” that run as another tab alongside their default New Relic views. While Datadog has APIs available to insert data, the user currently does not have the ability to create a custom monitoring application on the Datadog platform. Whether this new capability from New Relic will resonate with customers remains to be seen.

• New Relic also promotes the architecture of their data store, the New Relic Database (NRDB), as a competitive advantage. The CEO claims it was purpose-built, and has advantages in terms of scalability and native multi-tenancy over competitors, which leveraged open source packages to build their platforms. Competitive offerings, from his perspective, are running on single-tenant database architectures, which will make them more expensive to run at scale. I don’t necessarily agree with these assertions. At minimum, we haven’t seen them translate into significant business outperformance.

• New Relic does not currently offer solutions for network or security monitoring. As discussed previously, some enterprises may prefer an observability bundle that extends to security use cases.

Splunk (SPLK)

Splunk reported Q1 FY2021 (April end) earnings results on May 21. They missed revenue expectations for the past quarter and issued forward guidance for the current quarter was far below expectations on revenue. They also withdrew guidance for the current fiscal year. However, they surprised the market with strong growth in ARR and RPO, which they consider better measures of business progress. This is due to the impact of their transition to a cloud subscription model and the associated changes to revenue recognition. The market reacted positively the following day, with the stock gaining 12.7% and hitting an all time high.

• Q1 FY2021 (April end) Revenue of $434.1M, up 2.2% year/year. This compares to consensus estimate for $443.6M.
• Q1 FY2021 EPS of $(0.56) vs. $(0.57) consensus.
• Q1 Non-GAAP operating loss of $111M, representing an operating margin of -25.6%
• Q1 FCF of $31.3M, representing a FCF margin of 7.2%.
• Q2 FY2021 (July) revenue estimate of $520M vs. $549.5M consensus. This represents roughly flat year/year growth.
• Q2 FY 2021 Non-GAAP operating margin is expected to be between -10% and -15%.
• Withdrew previous guidance for FY2021, but management stated they are confident in an ARR growth target of mid-40% this year. I think this is the headline metric.

• Gross margin was 76%, versus 81.6% a year ago. The decrease is due to a larger mix of cloud revenue, which has a lower gross margin.
• ARR was $1.775B, up 52% year/year. Management feels this is the best measure of their growth currently.
• Cloud revenue was $112M, up 81% year/year. Highlights rapid uptake of their cloud solution by customers.
• Total RPO of $1.72B at end of Q1, up 44% from Q1 FY2020.
• At end of Q1, 65% of total revenue and 82% of cloud revenue was from customers based in the U.S.
• 81 customers had new orders worth more than $1M in Q1, up 76% year/year.
• Management highlighted some significant new and expanded customer wins in the quarter: Allied Irish Bank, Autodesk, Experian, Hitachi Capital (England), Kayak, Mount Sinai Health System, Santander Bank (Spain), Shopify, State of Illinois, Statkraft (Norway), Square Enix (Japan), Take-Two Interactive Software, TD Ameritrade, Transurban (Australia), Zoom
• On the earnings call, management provided more detail on a few customer wins:
  • Zoom (ZM) became a new Splunk Enterprise Security customer. With enterprise security, Zoom will gain an analytics-driven SIEM solution, giving them visibility into potential security threats as users engage with their video conferencing product.
  • Longtime customer, Allied Irish Banks, expanded their use of Splunk Enterprise and ITSI to help provide insights and take action on increased digital transaction data. With higher activity on their systems due to COVID-19, AIB leveraged Splunk to ensure a stable and reliable payment experience for customers.
  • Shopify, a longtime customer, significantly expanded their use of Splunk, by purchasing the newly launched SignalFx Microservices APM service. Shopify selected Splunk to help maintain their high observability standards as they grow in scale and complexity.
  • Take-Two Interactive Software expanded their use of Splunk Cloud to increase visibility into their environment.
• Announced that Gartner reported Splunk has earned the greatest market share for Performance Analysis in the AIOps, ITIM and Other Monitoring Tools subsegment for 2019. According to the report, Splunk is ranked first with 16.5% market share, with an increase to $919.7M in total revenue. IBM is second with 13.2% and Microsoft is third with 8.4% market share.
• Recently announced the newest version of SignalFx Microservices APM. The cloud-native SignalFx Microservices APM offering is a complete observability solution that supports monitoring and management of complex and distributed application portfolios.
• Announced a new, strategic partnership with Google Cloud, which will bring Splunk Cloud to GCP.
• Splunk and AWS also announced the newly launched AWS Service Ready program, Lambda Ready, which recognizes Splunk’s to support serverless applications.
• On the earnings call, management mentioned that they saw sustained demand for security use cases, driven largely by increased work-from-home activity.

Splunk Take-Aways

• Splunk is undergoing a multi-year migration to a cloud delivery and subscription revenue model. This is impacting revenue in the near term, as they transition from recognizing upfront term license revenue to ratable services revenue across the contract lifetime. This quarter’s increase in ARR of 52% was the top-line metric that analysts keyed upon, along with projected ARR growth of mid-40% for the remainder of the fiscal year. Management highlights ARR as the optimal indicator of growth because it normalizes the impacts from term cloud mix and contract duration.

• The revenue recognition shift is also affecting forward revenue and operating margin projections for Q2. Because the transition to cloud will be higher than expected in Q2, this is causing a greater decrease in year/year recognized revenue growth and consequentially, a negative operating margin. For Q4, Splunk reported that cloud revenue represented 35% of total software bookings for the year. They had expected that to increase linearly to 60% by FY2023 (3 years). However, in Q1, cloud bookings jumped to 44% of total. So, the transition to cloud appears to be accelerating, which is further pressuring revenue mix. For the current fiscal year, they now expect cloud to represent a high 40% of total ARR.
• While this transition period is muddling financial metrics, the long term growth model appears solid. Despite pulling revenue guidance, they re-affirmed target ARR growth of mid-40% for this year and a 40% CAGR for the next 3 years. This would result in ARR of $4-5B in FY2023 and about $1B of operating cash flow.

• Splunk has been moving customers to an infrastructure-based pricing model, transitioning away from a data ingest fee structure. This was a big customer complaint in the past with Splunk. As a result, they are seeing customers ingesting larger data sets, but still have capacity for more. Long term, they think this pricing model will be beneficial because customers will be able to drive more value through increased data usage, which will translate to more infrastructure expansion.
• Growth is expected from their new application-oriented observability suite, referring to the APM offering acquired from SignalFX last year. Additionally, Splunk offers a digital operations management tool through VictorOps. They are building a new “mission control framework”, which will provide an advanced interface for teams to integrate the different Splunk offerings with other third-party tools.

Elastic (ESTC)

Elastic will report earnings on June 3rd. This should provide additional insight into Elastic’s progress. Elastic offers an open, programmable platform for data ingestion, search and visualization. This has been applied to observability and security use cases through pre-built solutions on top of the generic platform. Elastic’s offering appeals to enterprises with a developer mindset and the ability to invest more effort towards set up and configuration, and hence customization.

This ability to customize has resulted in deep integrations of the Elastic platform into customer infrastructure. Many unique configurations are highlighted in the customer stories available on Elastic’s site. These are worth review by investors interested in the Elastic story as the dependence on the Elastic platform at some companies is significant. This level of customization and integration would result in higher switching costs than for other observability solutions. Because data collection agents are trivial to deploy across an infrastructure, they are also easy to swap out.

The versatility of the Elastic platform would appeal to some customers who want to minimize vendor spread. In theory, Elastic solutions could be used for several use cases and have been at some reference customers. An example is Tinder, where Elasticsearch not only generates all profile matches through an extensive application of faceted search, but is also used to process 17B user events a day to track product performance metrics. Use cases at other customers include recognized applications, like observability, security and site search, but also custom data processing and retrieval use cases that are unique to that customer’s circumstances, like fraud detection, network routing and IoT. Elastic’s usage based pricing model makes this possible, as customers just pay for the Elastic clusters utilized and can apply any type of data to them.

Because of its versatility as a programmable data ingestion, search and visualization platform, I put Elastic in a different category than the other observability vendors discussed. To me, it is more closely associated with data storage and retrieval, like a highly customizable data management platform. For investment allocation, I associate it with other data management providers, like MongoDB (MBD). I realize this doesn’t align with the perspective of other investors and seems counterintuitive. For simplicity, I won’t try to directly compare Elastic and Datadog for the purposes of this competitive analysis.

Financial Metric Comparison

To help investors evaluate the progress of Datadog relative to direct competitors in observability, we can compare recent financial performance across DDOG, DT, NEWR and SPLK. Financial metrics are Non-GAAP and for the latest quarter.

Metric	DDOG	DT	NEWR	SPLK
Total Revenue	$131M	$151M	$160M	$434M
Revenue Growth	87%	30%	21%	2%
RPO Growth	82%	56%	NA	44%
ARR Growth	NA	42%	17%	52%
Gross Margin	80%	83%	84%	76%
Op Margin	12%	24%	2%	-26%
R&D	27%	15%	20%	29%
S&M	32%	33%	48%	59%
G&A	9%	11%	14%	14%
FCF Margin	15%	42%	32%	7%
DBNER	> 130%	123%	116%	NA
Market Cap	$19.4B	$10.1B	$3.9B	$28.6B
P/S Ratio	38.8	18.2	6.4	11.7

Some observations:

• Datadog has the highest revenue growth metrics, including RPO and DBNER.
• Dynatrace has the best profitability metrics, including both operating and FCF margins.
• Datadog and Splunk are spending significantly more than Dynatrace and New Relic on R&D.
• Datadog has the most efficient sales motion.
• Splunk generates almost 3x more revenue and also spends the most as a percentage of revenue than the others. This just highlights the large amount of total dollar investment they are making in R&D and S&M.

Gartner – Magic Quadrant for APM

Gartner released their Magic Quadrant for APM in April, 2020. As part of this year’s report, they included Datadog, Splunk, Dynatrace and New Relic in their evaluation. As investors will recall, Datadog and Splunk were not included in the 2019 report and were relegated to Honorable Mention status, because they didn’t meet all requirements for inclusion.

In this year’s report, Dynatrace and New Relic were placed in the Leader’s quadrant, which is the same as the 2019 report. Splunk and Datadog were added as Visionaries. Dynatrace was given the coveted position “further up and to the right”. In a separate Critical Capabilities report for APM issued by Gartner, Dynatrace earned the highest score for 5 of 6 capabilities.

In this year’s survey, Gartner considers basic infrastructure monitoring, tracing and logging to be table stakes for vendors. They are placing more emphasis on how these inputs translate into the overall digital experience and efficiency of operational management. Gartner expects vendors to apply intelligence to correlate events, proactively identify anomalies and surface possible root causes. This process is sometimes referred to as AIOps.

Examining Gartner’s commentary associated with each vendor helps shed some light on perceived strengths and challenges:

Datadog

Gartner commends Datadog’s simplified deployment, based on using a single agent to collect all data types (metrics, logs, traces) on each host. This makes roll-out and management for DevOps teams easy. Extensive third-party system integrations are available and span all types of deployment models including orchestration, containers, cloud, service mesh, IoT and data stores. Gartner claims that Datadog’s pricing is lower than other competitors, with host-based, per unit pricing for APM. Also, Datadog is reported as being the most technically savvy, rapidly advancing support for the latest architectures and application configuration techniques. On the downside, Gartner claims that workflows for Datadog’s APM troubleshooting are less mature than other offerings, as is the granularity of call stack tracing. Gartner also points out that professional services and partner support is nascent, which is a fair observation, as Datadog recently rolled out its Partner Network program in January.

Overall, Gartner’s perception of Datadog seems to be hinged on their “newness” to the enterprise stage, referencing the August 2019 IPO and less mature capabilities several times. It’s not totally clear to me where these perceived gaps lie, but they don’t seem to be blocking adoption by technically savvy engineering shops.

Dynatrace

Dynatrace’s solutions are available for a variety of environments, including on-prem, hybrid and SaaS. Gartner highlights the AI/ML capabilities that Dynatrace layers on top of all monitoring functionality. AI algorithms continuously process incoming event, metric and trace data to identify anomalies and associate those with a likely root cause. Also, Dynatrace has moved towards support for business analytics by connecting application performance to customer experience and business outcomes. Gartner calls out Dynatrace’s strong go-to-market motion, with focus on the largest global enterprises and a deep network of SIs and software resellers. Gartner does mention that some customers report that the Dynatrace pricing model is confusing.

Gartner’s emphasis on AI/ML dovetails with Dynatrace’s own positioning that their intelligent platform can reduce headcount overhead in Ops by making alert response more efficient. They also reinforce Dynatrace’s move towards solutions in business analytics, at as far as connecting application performance to KPIs for digital businesses.

New Relic

Gartner recognizes that New Relic was the first vendor to offer a SaaS-based APM product. They call out the New Relic One platform for its ability to ingest data from any source (including competitors) and the programmability to create customer views of customer data across multiple domains. Also, highlights their AIOps capabilities, gained with the acquisition of SignifAI in 2019, and new serverless monitoring powered by IOpipe. Future product direction hinted at IT operations management. Customers gave New Relic strong ratings for on-boarding, service and support. On the downside, Gartner calls out the need for multiple agents to cover all frameworks and environments and their lateness to developing a logging solution.

Gartner’s feedback on New Relic aligns with what I would expect. While New Relic was first to market with APM, they delayed expansion into other components of observability. They became comfortable with the traditional split of IT Ops use cases between New Relic for APM and Splunk for logging, until Datadog rolled all of these up into one solution. Highlighting the New Relic One platform and its open, programmable approach is important, as this is a big part of New Relic’s strategy going forward. It remains to be seen if this will appeal to a large swath of customers, though.

Splunk

Splunk had previously focused on their logging and security solutions and are a recent entrant into APM through the acquisition of SignalFx in October 2019. SignalFx provided Splunk with a SaaS-only APM and infrastructure monitoring solution. This was rounded out with tracing through another acquisition of Omnition in September 2019 . These are added to Splunk’s existing strength in data collection and analysis, as well as their IT operations solutions with IT Service Intelligence, VictorOps and security solutions. Splunk has a strong go-to-market strategy with heavy investment in a high-touch, multichannel enterprise sales model. Splunk also has deep relationships with SIs and software distributors. In terms of competitive challenges, Gartner marks down SignalFx’s capabilities in digital experience management, connection to business analytics and usability.

At this point, Splunk probably has the broadest set of offerings for enterprises looking for one solution to combine application observability and IT operations management. The fact that Splunk also has a strong security offering puts it on par with Datadog for customers looking to consolidate tooling for application and security monitoring. Splunk also has broad penetration within the largest global enterprises and can leverage these relationships to promote its broader solution offering.

Gartner – Magic Quadrant for SIEM

In the context of this discussion about observability, it is worth noting that Splunk is also included in Gartner’s Magic Quadrant for SIEM (Security Incident and Event Management) published in February 2020. According to Gartner, “SIEM technology aggregates event data produced by security devices, network infrastructure, host and endpoint systems, applications and cloud services.” That description sounds like observability, but for security monitoring. Splunk is placed in the Leader’s Quadrant, as they have been for several years. None of the other observability vendors are included. Datadog recently released their Security offering to GA, which would explain why they weren’t included. Gartner did mention Elastic as providing a SIEM solution, but they didn’t meet all the inclusion criteria. Referring to Elastic, Gartner mentioned “customers have expressed interest in whether they might be able to satisfy security use cases and enable a single log and event collection architecture for security and for IT operations.” This point underscores the argument being made by Datadog, that providing a consolidated toolset for application observability and security would appeal to customers.

My Take-aways

• Datadog’s growth metrics continue to excel. They beat competitors on all metrics associated with year/year sales growth (revenue, billings, RPO, etc.). They are also improving the bottom line and showing efficiency in their sales organization investment.
• Datadog customer growth continues to be strong. Total customer count grew 40% year/year and customers spending more than $100k ARR grew 89%. This reflects the broad opportunity available and underscores the “greenfield” state of the market. With less than 5-10% of application footprint monitored, there is clearly a land grab occurring.
• The rate of customers using more than one Datadog product is expanding rapidly. In this regard, Datadog is growing along two dimensions. First, they are rapidly adding new monetizeable products – four out of seven SKUs moved to GA in the last year. Second, customers expand into consuming more of these products over time. This combination of growth in product offerings and number of product subscriptions per customer will be a strong revenue driver for some time to come.
• Security should be a differentiator for Datadog among competitive solutions. I agree with the Datadog CEO that IT organizations would prefer to consolidate their toolset for monitoring application performance and security into a single system. I have witnessed the “separation” of DevOps and SecOps teams at past technology organizations. Consolidation of systems provides clarity and cost leverage. In this vein, both Datadog and Splunk currently have security offerings and can reinforce this theme in their product marketing.
• Datadog continues to maintain the strongest perception of advanced technology and ability to keep up with modern architectures. The CEO continually mentions assembling the best engineering team and being on the look-out to opportunistically hire talent, particularly in this environment. This strong technology bias will play well with discerning buyers.
• Datadog’s speed of product development, along with their strong engineering culture, will be a competitive advantage. As we consider future product expansion opportunities for Datadog, some of these come to mind:
  • IT Ops Management. Basically, leveraging the performance data and insights they generate to take action. This could represent a new offering in incident management (like Splunk’s VictorOps product) or proactive configuration management for production infrastructure.
  • Services to address steps in the development cycle before code hits production. These could be offerings in code review, security vulnerability scanning and release management.
  • Business analytics. Since Datadog already collects application monitoring data and has a large scale data processing engine with flexible integrations, they could extend into tooling for monitoring the overall customer experience and performance against business KPIs.

Risks and Items to Watch

• While Datadog’s annualized revenue growth has remained in the 80% range, I worry how sustainable that is over the next couple of years. If revenue growth slows in 2021 to 50-60%, I wonder how that will impact valuation, which is arguably high at around a 40 P/S ratio. I don’t think that represents a risk for 2020, but could beyond this year. The low 5-10% penetration of enterprise application monitoring gives lots of runway for now, but could become a headwind in the future as this percentage increases and competitors grab low hanging fruit with mainstream enterprises.
• The competitive environment is tightening up.
  • Coming out of 2019, Splunk, New Relic and Dynatrace all have the primary components to claim a full-featured observability solution.
  • Splunk and Dynatrace have strong penetration with the large, traditional enterprises, and might block out this growth vector for Datadog, or at least dilute it. Dynatrace added over 1,000 new customers year/year and they target the largest 15,000 global enterprises.
  • Dynatrace received the highest marks from Gartner in their APM Magic Quadrant. These industry surveys tend to influence the more mainstream enterprise buyers and certainly make for a good product marketing headline.
  • Splunk also already has a leading SIEM solution, while Datadog just launched theirs. This puts Splunk in a favorable position relative to the SecOps/DevOps consolidation argument. Splunk’s security solution brought Zoom in as a new customer.
  • Dynatrace has strong profitability metrics, which may appeal to more value-oriented investors.

Investment Plan

I think there are two approaches investors could take with Datadog and the observability space. At the simplest level, they could pick the winner based on current revenue growth and product development momentum. Observability is a huge, mostly untapped market with new use cases emerging continuously. Datadog’s execution should keep it ahead of the pack as they grow into a multi-billion dollar player over the next five years. That thesis is straightforward and would argue for an entry into Datadog now with a long term horizon.

Another approach would be to bet on observability in general and assemble a basket of observability names. This would capitalize on the fact that the market for application/security/IT monitoring solutions is large, under-penetrated and likely continuing to expand. This bets on digital transformation secular trends and the need for enterprises to continue to move all customer experiences online. For the observability basket, I favor Datadog and Splunk. This balances Datadog’s rapid growth with Splunk’s breadth of offerings and customer penetration. I realize this leaves out Dynatrace and New Relic. I think they will continue to perform well, but I have concerns about growth.

For remainder of this year, Splunk is expecting ARR growth in the mid-40% range and affirmed a 3 year forward ARR CAGR of 40%. Dynatrace ARR growth is estimated at 19-21% for this year, while New Relic expects 13-14% growth. Granted, these could be conservative, but that conservatism could also apply to Splunk. I think it is fair to assume Datadog will deliver greater than 40% growth for several years.

This recommendation doesn’t account for profitability levels, as my assumption is that any of these companies should be able to generate meaningful cash flow at scale. To be fair, Dynatrace is the most profitable at this point and could be allocated a share of the basket for that reason. Also, I am not trying to adjust for current valuations. Investors can adjust their blend of the basket percentages to include assumptions about growth relative to valuation multiples.

I am putting Elastic in a separate investment bucket. While they provide overlapping solutions for observability and security, the core of their platform is enabling a programmable solution for data storage and retrieval through search. I see more parallels with MongoDB, as an example, and will wait until ESTC reports on June 3rd to provide an update on my Elastic thesis. I can see an argument to create a data storage category in my software stack portfolio and manage my allocations that way.

I will wait one more quarter before initiating a position and setting a price target for Datadog, as I want to honor my rule to wait for four quarters of earnings before investing in a new IPO. For investors who are eager to jump in, I think you are safe for the remainder of 2020. Datadog’s momentum is unlikely to end this year. In the meantime, I will continue to track Datadog and the other names in the observability space and provide investor updates.