Investor and Analyst Session Splunk .Conf20 © 2020 SPLUNK INC

Introduction and Overview Analyst and 1 Investor Session Doug Merritt, President and CEO

Product Deep Dive 2 Agenda Tim Tully, Chief Technology Officer GTM and Customer Case Studies 3 October 21st Christian Smith, Chief Revenue Officer 10:30am Financial Outlook 4 Jason Child, Chief Financial Officer

5 Q&A During the course of this presentation, we may make forward-looking statements regarding future events, our products, technology, strategy, acquisitions, investments, total addressable markets, competitive position, momentum and growth in our customers, business Safe Harbor and offerings, and the expected financial performance of our company including statements about our models, future growth, growth rates and related targets, such as software bookings mix, full year and long-term cloud gross margin, annual recurring revenue operating margin, long-term annual recurring revenue and operating cash flow and trends in our markets. These statements reflect management’s Statement current expectations, estimates and assumptions based on the information currently available to us. These forward-looking statements are not guarantees of future performance and involve significant risks, uncertainties and other factors that may cause our actual results, performance or achievements to be materially different from results, performance or achievements expressed or implied by the forward-looking statements contained in this presentation.

A discussion of factors that may affect future results is contained in our most recent SEC Form 10-Q filing available at www.sec.gov, including descriptions of the risk factors that may impact us and the forward-looking statements made in this presentation. The forward-looking statements made during this presentation are made as of the time and date of this presentation. If this presentation is reviewed after the date hereof, even if made available by us, on our website or otherwise, the information and statements contained herein may no longer be current or accurate. We disclaim any obligation to update or revise any forward-looking statement based on new information, future events or otherwise, except as required by applicable law.

We will also discuss non-GAAP financial measures. These non-GAAP financial measures are presented for supplemental informational purposes only and should not be considered a substitute for financial information presented in accordance with GAAP. These non-GAAP financial measures have limitations as analytical tools, and they should not be considered in isolation or as a substitute for analysis of other GAAP financial measures. A reconciliation of historical GAAP and non-GAAP financial measures is provided at https://investors.splunk.com. A reconciliation of forward-looking GAAP and non-GAAP measures is not available without unreasonable effort due to the uncertainty regarding, and the potential variability of, many of these costs and expenses that may be incurred in the future.

In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. We undertake no obligation either to develop the features or functionalities described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Data-to-Everything, D2E and Turn Data Into Doing are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names or trademarks belong to their respective owners. © 2020 Splunk Inc. All rights reserved. © 2020 SPLUNK INC.

Doug Merritt President and CEO Splunk Corporate Template – FY21 TMPLT-2020v2.1

Total ARR Growth

Sustained

Growth & ARR % represents YoY growth Cloud Contribution Customers with to SW Bookings ARR Over $1M Execution (Period Exit Rates) ~ Splunk Corporate Template – FY21 TMPLT-2020v2.1

ARR Growth at ~$2B Outpacing Our Software Peers at Scale

Source: Splunk, Company Reports. Workday, Salesforce, and ServiceNow ARR based on subscription sales. % represents YoY growth. Splunk Corporate Template – FY21 TMPLT-2020v2.1

3 Essential Transformations

Transformation #1 Transformation #2 Transformation #3 Become a Deliver the Reimagine World-Class World’s First Our Business Cloud Data-to- Fundamentals

Provider Everything Platform Splunk Corporate Template – FY21 TMPLT-2020v2.1

Transformation #1 Become a World-Class

Cloud Provider Splunk Corporate Template – FY21 TMPLT-2020v2.1

Q2’21 Total Software Bookings

Splunk Is Officially a

47% 53% Cloud-First On-Prem Cloud Company Splunk Corporate Template – FY21 TMPLT-2020v2.1

Cloud ARR Growth 89 % 82 80 % % Hypergrowth in 86 % 81 % Cloud $M

% represents YoY growth Splunk Corporate Template – FY21 TMPLT-2020v2.1

% 89

% Nearly 2x 48 Growth Compared to Cloud Peers

Top 10 Public Cloud Companies Under $1B in ARR

Splunk Cloud ARR as of Q2-2021 % represents YoY growth Splunk Corporate Template – FY21 TMPLT-2020v2.1

Share of Cloud ARR, Hybrid vs. Fully Cloud Customers Splunk Cloud Customers Operate in Both Hybrid and 58% 42% Fully Cloud Environments

Pure Cloud Customers Hybrid Cloud Customers

Splunk data as of Q2-2021

Source: Splunk data as of Q2-2021 Splunk Corporate Template – FY21 TMPLT-2020v2.1

Transformation #2 Deliver the World’s First Data-to-Everything

Platform Splunk Corporate Template – FY21 TMPLT-2020v2.1

Security IT Observability

Common Work Surface, APIs, Developer Tools | Mobile & Connected Experiences

Stream Machine Scalable Federated Search Collaboration and Processing Learning Index and Analytics Orchestration

Hybrid and Multicloud Ingestion and Processing Splunk Corporate Template – FY21 TMPLT-2020v2.1

Three Focus Areas for Our Solutions

Security IT Observability Splunk Corporate Template – FY21 TMPLT-2020v2.1

Splunk Leads in All Three Markets

Security IT Observability

Source Security: Gartner Market Share Analysis; Security Software, Worldwide 2019, June 2020 Source IT: Gartner Market Share Analysis; ITOM, Performance Analysis Software, Worldwide 2019, June 2020 Source Observability: Gartner Inc. Gartner Magic Quadrant Application Performance Monitoring, C. Rich, F. De Silva, April 2020 Splunk Corporate Template – FY21 TMPLT-2020v2.1

Investigation and Forensics

SIEM/Security Analytics

Automation and Orchestration

Security Incident Response

Unified Security Operations

IT Observability Splunk Corporate Template – FY21 TMPLT-2020v2.1

IT Investigation and Monitoring

Event Analytics and Management

Service Monitoring and Insights

Incident Response and Automation

AIOps

Security Observability Splunk Corporate Template – FY21 TMPLT-2020v2.1

Cloud Infrastructure Monitoring Log Investigation Application Performance Monitoring Digital Experience Monitoring SRE/DevOps Incident Response OpenTelemetry

Security IT Splunk Corporate Template – FY21 TMPLT-2020v2.1

Transformation #3 Reimagine Our Business

Fundamentals Splunk Corporate Template – FY21 TMPLT-2020v2.1

Workload- Aligned to Value Based Flexible

Pricing Predictable Splunk Corporate Template – FY21 TMPLT-2020v2.1

Fortune 100 Customer

Tim Tully Chief Technology Officer and SVP Splunk Corporate Template – FY21 TMPLT-2020v2.1

• Data-to-Everything Three Areas Platform of Focus • Cloud for the Data Age Today... • Splunk Solutions Splunk Corporate Template – FY21 TMPLT-2020v2.1

Only

Splunk Splunk Corporate Template – FY21 TMPLT-2020v2.1

Market-Leading Portfolio

Security IT Observability

Common Work Surface, APIs, Developer Tools | Mobile & Connected Experiences

Stream Machine Scalable Federated Search Collaboration and Processing Learning Index and Analytics Orchestration

Hybrid and Multicloud Ingestion and Processing Splunk Corporate Template – FY21 TMPLT-2020v2.1

Federated Stream Machine Scalable Search and Collaboration Processing Learning Index Analytics and Orchestration Splunk Corporate Template – FY21 TMPLT-2020v2.1

and multicloud environments

IT Security

Observability

We Offer a Fully Connected Data Platform Splunk Data Stream Processor creates one logical data pipeline from extreme edge to cloud On Premises Cloud

On Premises / Cloud Cloud Custom Log Formats Public DSP SignalFX Cloud Blob Storage

Public Custom Log Formats SignalF Cloud Custom Log Formats x Blob Storage

Data Cubes, Metrics, Traces, Logs, Custom Formats Security | IT Ops | Observability | Other DSP

Data Cubes, Metrics, Traces, Logs, DSP Custom Formats

Data Cubes, Metrics, Traces, Logs, Custom Formats

Public Alternate 1 Cloud Blob Storage

DSP

Data Cubes, Metrics, Traces, Logs, Custom Formats

Alternate 2

Public Cloud Blob SECURITY | IT OPS Storage OBSERVABILITY | OTHER

DSP

Data Cubes, Metrics, Traces, Logs, Custom Formats Splunk Corporate Template – FY21 TMPLT-2020v2.1

Splunk Leads in All Three Markets

Security IT Observability

Splunk

Streaming ML

Unrestricted Learning by volume, cardinality and flexibility Splunk Corporate Template – FY21 TMPLT-2020v2.1

to Become Cloud Native Splunk Corporate Template – FY21 TMPLT-2020v2.1

Converged Four-Week Architecture Release Cycle Multicloud

Evolving to stateless, Six-week release cadence Supporting multiple cloud elastic architecture shifting to four weeks service providers API-first approach Delivering innovation faster Splunk Corporate Template – FY21 TMPLT-2020v2.1

All New Rebuilt for Splunk The Data Age Cloud Splunk Corporate Template – FY21 TMPLT-2020v2.1

Observability Splunk Corporate Template – FY21 TMPLT-2020v2.1

Retain and Lift and Rearchitect / Optimize Shift Refactor Cloud-Native

VM VM VM VM VM Private Public

DC VM VM VM Private DC VM VM VM VM Public Private Public Splunk Corporate Template – FY21 TMPLT-2020v2.1

Capability Splunk

Metrics and Infrastructure Monitoring ✓

Tracing and APM ✓

Log Investigation ✓

Byte Code Instrumentation ✓

Real User Monitoring ✓

Synthetic Monitoring* ✓

Full-Fidelity Ingestion ✓

*Subject to completion of the acquisition of Rigor. Splunk Corporate Template – FY21 TMPLT-2020v2.1

Open Standards Observability Data Collection Suite Splunk Corporate Template – FY21 TMPLT-2020v2.1

A New Standard for Observability Splunk Corporate Template – FY21 TMPLT-2020v2.1

Market-Leading Portfolio

Security IT Observability Splunk Corporate Template – FY21 TMPLT-2020v2.1

Market-Leading Security Portfolio

Investigation and Forensics

SIEM/Security Analytics

Automation and Orchestration

Security Incident Response

Unified Security Operations

IT Observability Splunk Corporate Template – FY21 TMPLT-2020v2.1

A Cloud-Based, Unified Security Operations Platform Mission Control Splunk Corporate Template – FY21 TMPLT-2020v2.1

Market-Leading IT Portfolio

IT Investigation and Monitoring

Event Analytics and Management

Service Monitoring and Insights

Incident Response and Automation

AIOps

Security Observability Splunk Corporate Template – FY21 TMPLT-2020v2.1

LAR

Splunk Service Intelligence for SAP® Solutions Splunk Corporate Template – FY21 TMPLT-2020v2.1

Only

Christian Smith Chief Revenue Officer and SVP Splunk Corporate Template – FY21 TMPLT-2020v2.1

• Cloud First Three Areas • Focus on Buying Centers of Focus • Holistic GTM Strategy Today Splunk Corporate Template – FY21 TMPLT-2020v2.1

Customers featured at .conf20 Splunk Corporate Template – FY21 TMPLT-2020v2.1

Anticipate Customer Needs

Navigate Complex Technical Landscape

Understand Customer Challenges Splunk Corporate Template – FY21 TMPLT-2020v2.1

Cloud First,

Not Cloud Only

• Evolve Capabilities • Negotiate Hybrid Environments • Accelerate Digital Transformation Splunk Corporate Template – FY21 TMPLT-2020v2.1

Experience • Real data leads to real insights, at Cloud speeds, while fueling Cloud adoption

• Driving 100% remote technical wins during COVID-19

• Use cases that cover more than 90% of our more than 20,000 customers critical needs Splunk Corporate Template – FY21 TMPLT-2020v2.1

• real-time product feedback

• on-demand content • in-product guidance and best practices • unique and differentiated Machine Learning Splunk Corporate Template – FY21 TMPLT-2020v2.1

Buying Centers

IT Ops Security DevOps Splunk Corporate Template – FY21 TMPLT-2020v2.1

Buying Centers Application performance management Single Network Packet Capture Network solution Breach Integrated SecOps (Splunk Enterprise) Anomaly Detection Detection Worksurface IOT/Cloud Mobile App Troubleshooting

2012 2013 2014 2015 2016 2017 2018 2019 2020+

Security Incident Event Infrastructure IT Service Monitoring Orchestration & Mobile apps Management (SIEM) monitoring User behavior automation Augmented reality HDFS storage & analytics Virtual reality PCI compliance data retrieval Business transaction monitoring ML mapping Stream Experimentation On-call coordination & Processing incident response Security Use Case Examples Splunk Corporate Template – FY21 TMPLT-2020v2.1

Mars, Inc.

• Started as one of many tools - expanded to become THE data platform • Integration helped optimize Security and IT Ops • Mars started with Splunk for security and IT and quickly become the default tool for analytics across Mars’ businesses • 300+ users all self-serving their own insights from Splunk

“ As we mature with it, it’s become apparent that Splunk is the solution for our broader issues as well. Now, we have over 300 users all self-serving their own insights from Splunk. In addition to monitoring insights, we’re also looking forward to using machine learning for predictive capabilities.” ~ Antonio Guedes, Security Analytics Senior Lead at Mars Splunk Corporate Template – FY21 TMPLT-2020v2.1

GTM Strategy • Simplified marketing and messaging • Dedicated Renewals Team - Selling to 100% coverage Buying Centers • Customer success across entire base • Centers of Excellence for buying center expertise and lower cost (pre-sales, renewals, customer success) • Partner GTM re-aligned to Route to Market and Program Evolution • Investments focused in top TAM countries • Buying Center Sales Representatives Splunk Corporate Template – FY21 TMPLT-2020v2.1

Workload Pricing

Allows customers to Provides additional Removes data pay for the value they flexibility for ingest as a barrier receive, not the experimentation volume they put in Splunk Corporate Template – FY21 TMPLT-2020v2.1

Workload Pricing

“ Splunk Cloud definitely allows us to

move faster, ship faster and fix faster.”

— Head of Cloud Engineering Splunk Corporate Template – FY21 TMPLT-2020v2.1

Accelerated Digital FY21 COVID-19 Accelerated Transformation Digital Journey FY20 Massive Digital Push

FY19 Selected Splunk for Enterprise ARR Growth Observability Platform

FY18 Cloud first data transition

FY16 Selected SignalFx for Cloud Infrastructure Monitoring

FY15 Selected Splunk for Operational Monitoring Platform Splunk Corporate Template – FY21 TMPLT-2020v2.1

• Simplify the value of Splunk

Jason Child Chief Financial Officer and SVP Splunk Corporate Template – FY21 TMPLT-2020v2.1

• Market Opportunity • Growth Drivers and Five Areas Performance • Cloud Opportunity of Focus • Buying Center Opportunity Today... • Long-Range Plan Splunk Corporate Template – FY21 TMPLT-2020v2.1

Market

Opportunity Splunk Corporate Template – FY21 TMPLT-2020v2.1

$114B

$81B Security IT Observability

Common Work Surface, APIs, Developer Tools | Mobile & Connected Experiences

Hybrid and Multicloud Ingestion and Processing 2020 2023

Source: Calculations performed by Splunk based on Gartner and IDC research Splunk Corporate Template – FY21 TMPLT-2020v2.1

$17B $28B Observability / DevOps $81B IT Operations 2020 TAM $17B $19B Security, Compliance Platform / Other and Fraud

Source: Calculations performed by Splunk based on Gartner and IDC research Note: Platform / Other includes Business Analytics, and Industrial Data and IoT Splunk Corporate Template – FY21 TMPLT-2020v2.1

$81B ~2%

Splunk TAM Splunk ARR

Source: Calculations performed by Splunk based on Gartner and IDC research Splunk Corporate Template – FY21 TMPLT-2020v2.1

Growth Drivers

and Performance Splunk Corporate Template – FY21 TMPLT-2020v2.1

Growing Splunk Renewal Base Data Volume & Growth Drivers Infrastructure Expansion

Reinventing for Cloud

Cross Sell to Additional Buying Centers Splunk Corporate Template – FY21 TMPLT-2020v2.1

$1.6B 1.4x $1.4B 2.4x 2.6x $1.2B 4.6x $1B 5.3x

$800M 8.3x

$600M 9.0x 10.6x $400M 17.9x $200M 37.0x $0 FY10 FY11 FY12 FY13 FY14 FY15 FY16 FY17 FY18 FY19 FY20 Splunk Corporate Template – FY21 TMPLT-2020v2.1

ARR > $1M ARR > $5M ARR > $10M

396 39 355 30

220

124 8 6 4 2 0 1

FY18 FY19 FY20 Q2FY21 FY18 FY19 FY20 Q2FY21 FY18 FY19 FY20 Q2FY21 Splunk Corporate Template – FY21 TMPLT-2020v2.1

Best-in-Class DBNRR at Scale

$2.0B

$1.5B

$1.0B ARR

$500M

$- 100% 120% 130% 140% 150% 160% DBNRR Source: Wall Street Research, company filings, Splunk Q2-2021 Cloud DBNRR Companies included in benchmarking: APPN, AVLR, AYX, BILL, BL, COUP, CRWD, DDOG, DOCU, ESTC, MDB, NET, NEWR, OKTA, PING, PLAN, SNOW, SPT, TLND, TWLO, VEEV, WK, WORK, ZEN Note: DDOG discloses DBNRR of 130%+; SNOW ARR-equivalent used is “Product Revenue Run Rate” Splunk Corporate Template – FY21 TMPLT-2020v2.1

Cloud

Opportunity Splunk Corporate Template – FY21 TMPLT-2020v2.1

$2B Growing Renewal Base Drives ARR $1B Expansion Total ARR Estimated for Renewal

$0B FY18 FY19 FY20 FY21E FY22E FY23E Splunk Corporate Template – FY21 TMPLT-2020v2.1

High Cloud Bookings Mix, and low Cloud ARR 29% 47% 53% Mix highlights large 71% conversion opportunity

Non-Cloud Cloud

Splunk data as of Q2-2021 Splunk Corporate Template – FY21 TMPLT-2020v2.1

FY of Customer’s First Cloud Purchase Average ARR growth in the year a customer makes their first cloud FY16 2.6x purchase FY17 FY18 Average ARR growth 3 years after customer makes their first cloud Average ARR 5.4x purchase FY19 Post-First Cloud FY20 Purchase

Average ARR Pre-First Cloud Purchase Splunk Corporate Template – FY21 TMPLT-2020v2.1

Cloud Contribution to Total Software Bookings (period exit rate) 80%+ Cloud Expected to Drive More ~60% Than 80% of 42% 25% SW Bookings 22% in FY23

FY18 FY19 FY20 FY21E FY23E Splunk Corporate Template – FY21 TMPLT-2020v2.1

Buying Center

Opportunity

Buying Center Opportunity Splunk Corporate Template – FY21 TMPLT-2020v2.1

$2B Growing Renewal Base Drives ARR $1B Expansion Total ARR Estimated for Renewal

$0B FY18 FY19 FY20 FY21E FY22E FY23E Splunk Corporate Template – FY21 TMPLT-2020v2.1

8% Three Buying Centers

72% 20% One Buying Center Two Buying Centers

Security IT Observability

Splunk data as of Q2-2021 Splunk Corporate Template – FY21 TMPLT-2020v2.1

Average ARR growth in the year a FY of Customer’s First Shift to Multiple customer shifts from one buying Buying Centers center to multiple buying centers 2.3x FY16

Average ARR growth 3 years after FY17 customer shifts from one buying Avg. ARR per center to multiple buying centers 6.3x FY18 Customer after moving from one to multiple FY19 buying centers

FY20 Avg. ARR when purchasing from one buying center Splunk Corporate Template – FY21 TMPLT-2020v2.1

Average ARR per Account Customers purchasing across two buying centers have a 1 Buying Center ~4x greater average ARR compared to those purchasing 2 across one buying center Buying Centers and a ~9x greater average ARR 3 Buying Centers when purchasing across three buying centers compared to one

Splunk data as of Q2-2021 Splunk Corporate Template – FY21 TMPLT-2020v2.1

Long-Range Plan Splunk Corporate Template – FY21 TMPLT-2020v2.1

Cloud Gross Margin Leverage Gross Margin from Cloud (non-GAAP) 75%+ 70%

Margin Expansion 60% Drivers 53%

Stateless Architecture 38% Elasticity 27%

Multi-Tenancy

Scale

FY18 FY19 FY20 FY21E FY23E Long Term Splunk Corporate Template – FY21 TMPLT-2020v2.1

53% 54% 51% 52% 52% 50% 50% 46% 46% 44%

44% 44% 46% 44% 43% 43% 39% 40% 41% 42%

Q1-2019 Q2-2019 Q3-2019 Q4-2019 Q1-2020 Q2-2020 Q3-2020 Q4-2020 Q1-2021 Q2-2021 Q3-2021E Q4-2021E Normalized ARR Growth Perp Mix Shift SignalFx

‘Perp mix shift’ is an estimation of the Y/Y ARR growth contribution resulting from an estimated annual contract value (ACV) bookings mix shift away from perpetual licenses, which only generate ARR via maintenance fees, to renewable software, which generates ARR for the annualized full contract amount. The estimation applies a constant perpetual mix of the respective prior year and assumes that the shift away from perpetual licenses resulted in an equal shift towards term licenses. We assumed $1 of term license ACV yields roughly 2x the ARR of $1 of perpetual ACV based on an ACV calculation of perpetual as 1/3 of the software total contract value (TCV). Splunk Corporate Template – FY21 TMPLT-2020v2.1

Reiterating ARR Growth Trajectory

40% CAGR

$1.68B

FY20 FY21E FY22E FY23E Splunk Corporate Template – FY21 TMPLT-2020v2.1

Long-Term Operating Model Expenses (non-GAAP) as a percentage of ARR

FY18 FY19 FY20 FY21E FY23E Long Term

S&M 85% 77% 61% 46% 35% <32%

R&D 27% 28% 25% 23% 17% <16%

G&A 14% 14% 13% 11% 8% <7% ARR Operating -55% -44% -20% 1% 20% 25%+ Margin

ARR Operating Margin is ARR less non-GAAP cost of revenues and non-GAAP operating expenses divided by ARR Splunk Corporate Template – FY21 TMPLT-2020v2.1

Cash-Flow Transition Nearly Complete

Cash Flow Transition 30% 23% 24% 23% 23% 25% 21% 20% 20%+ 20% 15% 10% 5% OCF Yield

Non-GAAP 0% Operating Margin -5% -10% -15% FY13 FY14 FY15 FY16 FY17 FY18 FY19 FY20 FY21E FY22E FY23E

OCF as % of Revenue OCF as % of ARR OCF as % of Revenue is as reported (ASC 605 for periods FY13-FY18; ASC 606 for periods FY19 and later) _ Splunk Corporate Template – FY21 TMPLT-2020v2.1

Growing Splunk Renewal Base Data Volume & Growth Drivers Infrastructure Expansion

Reinventing for Cloud

GAAP to Non-GAAP Reconciliation