Why Cisco Bet $28 Billion on Splunk — The Pivot from Networking Hardware to Software Platform

By 2023 the cybersecurity and observability landscape was clearly converging. SIEM, XDR, observability, and AIOps were drifting into a single category as enterprises pushed workloads across multi-cloud and SaaS environments. Network telemetry, logs, metrics, and traces increasingly needed to live in one place, and the explosion of data created by generative AI made AI-driven operations and security analytics the next competitive frontier. Cisco, Palo Alto Networks, CrowdStrike, Datadog, and Microsoft Sentinel were each pushing toward full-stack platforms from different starting points.

Splunk sat among the top three SIEM vendors alongside IBM QRadar and Microsoft Sentinel, and was a top-five observability vendor alongside Datadog, New Relic, and Dynatrace. For Cisco, the strategic appeal was twofold: instant scale in both SIEM and observability, and a differentiated position combining network infrastructure telemetry with Splunk's machine-data platform, a combination that competitors would struggle to replicate organically.

Founded in 2003 and listed on Nasdaq in 2012 (ticker SPLK), Splunk built its franchise around the idea of searching and analyzing every kind of machine data. Over time it became a leader in both SIEM and observability, with headquarters in San Francisco. In FY2023 (ending January 2023) revenue reached $3.65B, up 37% year over year, while total ARR grew 18% to $3.67B and cloud revenue rose 54% to $1.46B. The company counted 790 customers with more than $1M in ARR and employed roughly 8,000 people globally. CEO Gary Steele, who joined in 2022, drove a sharp focus on cost discipline and margin expansion, a shift that materially increased Splunk's appeal to a strategic acquirer.

Revenue by Segment (FY2023)

FY2023 (year ended January 2023) estimated split. Splunk's reported segmentation is high level, so internal mix estimates apply.

The transaction was structured as a straightforward reverse triangular merger, with Cisco acquiring all outstanding Splunk shares at $157 in cash. Financing combined approximately $22B of new investment-grade debt with around $6B of balance-sheet cash, a financing that increased Cisco's leverage temporarily but did not rely on acquisition-finance bank loans. Regulatory clearances proceeded cleanly in the US, EU, and UK without remedies; SAMR in China provided the final approval, and the deal closed on March 18, 2024.

Cisco assembled a non-traditional advisory line-up, naming the newly formed boutique Tidal Partners as its sole financial advisor; the firm, founded by David Handler and David Neequaye, had only recently spun out of Centerview and Splunk effectively marked its first megadeal. Splunk retained the established pairing of Qatalyst Partners (Frank Quattrone's tech-M&A boutique) and Morgan Stanley as co-financial advisors. Skadden advised Splunk on legal matters; Simpson Thacher and Cravath split Cisco's legal work between M&A and financing/regulatory streams.

Advisory assignments based on the joint press release and SEC filings.

USD millions. Splunk Inc. annual financials, fiscal year ending January (FY2023 = period ending January 2023). GAAP operating losses reflect sustained SBC; non-GAAP margins improved sharply by FY2023 as the ARR-led SaaS model matured.

Cisco paid roughly 7.5x FY2023 revenue and 7.6x FY2023 ARR, a reasonable but not stretched multiple by 2023 software-M&A standards. Cloud-native SaaS peers traded at far higher multiples at the time (Datadog around 15x revenue, CrowdStrike around 14x, ServiceNow around 14x), but Splunk still carried a meaningful tail of perpetual license revenue, which weighed on the multiple. The 31% premium to the prior close was squarely within the typical megadeal range. Starboard's intervention, which lifted non-GAAP operating margin to 17.6% by FY2023, gave Cisco a cleaner profitability profile to underwrite, helping justify the headline price.

Valuation metrics based on the joint press release, Splunk's 10-K filings, and SEC 8-K disclosures.

Following the March 18, 2024 closing, Splunk has been operated as part of a combined Splunk and Cisco Security portfolio. Purchase-accounting effects, particularly the haircut to acquired deferred revenue, weighed on Cisco's reported FY2024 growth, but synergy-driven revenue began contributing more visibly through FY2025. Chuck Robbins routinely highlights Splunk integration milestones on earnings calls. The ~$22B of new debt pushed Cisco's leverage temporarily higher, with negative outlooks from S&P and Moody's at the time, but strong free cash flow has supported a steady deleveraging path. The strategic test now is competitive: AIOps and SIEM are intensifying, with Microsoft Sentinel and Palo Alto Cortex pressing hard, and the real proof of the deal will come from sustained cross-sell traction over the next two to three years.