Splunk’s CEO talks about with ChannelBuzz about the company’s expansion strategy, where he sees the company going, and the limits to innovation.

LAS VEGAS – The main themes of Splunk CEO Doug Merritt’s keynote address to the .conf attendees here this year were remarkably similar to those in last year’s .conf gala in Orlando. The tagline – Data to Everything – is new, and some new product and acquisition announcements added a touch of variety. Ultimately, however, the theme is the same. Splunk will leverage its strength in ingested data from their SIEM to broaden into more ways to analyze data for customers, and increase the use cases where they are deployed. They will also make the platform easier to use, opening it up to more types of users, as well as to data that resides outside of Splunk. Yet while the message is consistent, the theme underlying it is that the company has to continue to take major risks – but intelligent ones – or face being overwhelmed by the extraordinary pace of tech change today.

“My hope is that we remain disciplined with our messaging, so that the press will be bored next year,” Merritt told ChannelBuzz. “There’s so much about change management that the average user doesn’t understand. Staying on message can be boring for those who do know this well, but there are so many audience members we need to hit.”

Merritt emphasized that this has been a long-term strategy, and that it will continue.

“Three or four years ago, we had the opportunity to continue to polish Spunk Enterprise, our SIEM product,” he said. “That’s the foundation of the 30-40% software growth we have enjoyed. Many companies would have been satisfied with that. What we have done instead as a managed team is divert 30-40% of our annual budget into experimentation – around product, around training, around pricing.”

The radical pace of innovation makes this strategy essential, Merritt stressed.

“The marketplace is moving so quickly that if we don’t take risks, we will be one of those companies that was super-interesting for a moment in time and then becomes part of another company,” he said. “So we are making smart but experimental investments in the future.”

Merritt acknowledged that today most companies that deal with data – meaning most IT companies – stress these same themes as Splunk around the need to democratize data and use it to unlock insights.

“When discussing the whole  invention of opportunity, the challenge is that there is a limited number of worlds in the language, and that’s something that went back into the 90s with Business Intelligence.” He said. “But beyond the words, how you get it done is very different. Our differentiation is that we are the only company that took the view that it is important to structure data from a value perspective. That assumes that the world is chaotic and unmanageable. Our job is to see patterns in the chaos.”

It also lies in recognizing that much data is crap, and that that the value lies in finding the nuggets which are of value for each particular customer, and presenting it in a way that they can take advantage of it in a timely fashion.

“The issue is not the availability of data,” Merritt said. “It’s understanding what data is worth paying attention to. We are in a position that we sell the shovels and picks to the gold miner. The brilliant insight that Splunk’s technical cofounders had is that there was no standard for logs, and even time stamps just dump things into a swamp. So for many people, much data is junk, but what is of value changes depending on the problem and the person. Every investigation by nature has a unique set of questions and challenges, and the key is to be able to answer those in a way that is affordable. Part of the culture of Splunk that I love is the blue-collar part, breaking down stuff for the domain experts who are overwhelmed. Customers like Porsche now realize that data that we gather can be used for their specific Line of Business applications.”

Merritt also emphasized that with the exponential growth in the ability to store and use data, the ability to analyze data across repositories becomes more critical.

“We look at say, the in-memory vendors, as destinations for data that are complementary to the data in the Splunk Index,” he said. “That’s why we are launching federated search. It makes it super easy to curate data and push it anywhere, including in-memory data stores. Those platforms can do the job if all the data is in memory in their platform. But what if its not all there? That’s why we are so excited about Data Fabric Search.”

Merritt indicated that there are a few areas where Splunk has to be cautious about experimentation.

“The key is the reversibility of the experiment if it doesn’t work,” he said. “One of those things which we would not try would be anything relating to the security of our product, and things which could disrupt our cybersecurity.

“Pricing is another of those things,” he added. “It’s been a five-year journey to come up with the three new pricing options we announced here, because pricing is a big risk. If you get pricing wrong, the effects can be dramatic.”

Ironically, Merritt sees Splunk’s biggest untapped opportunities as being in security.

“The amount of penetration that we have in security, even though through we are often thought of as a large SIEM, is fairly low,” he said. “We are lightly penetrated there. Our three-year plan has us focused on the SOC and next generation NOC to expand that. They have massive needs that are still not fulfilled. Over the next 5-10 years, we will continue to invest in the ecosystem through Splunk Ventures. I want to see our 2000 Splunk-based apps go to 20,000, and then go to 200,000.”

Merritt also sees new types of revenue opportunities down the line.

“Right now, we are focused on helping people extract value from data,” he said. “Over time, we expect a lot of effort will go to providing information for remuneration, drawing on information from millions or billions of anonymized users.”