Cisco Buys Splunk: The $28 Billion Bet on Security, Observability, and Recurring Software Revenue

Cisco paid $157 per share to accelerate a business-model transition

Cisco announced in September 2023 that it would acquire Splunk for $157 per share in cash, representing approximately $28 billion of equity value.^[1] The strategic logic went beyond adding another security product. Cisco had spent years trying to increase the share of revenue generated by software, subscriptions, and recurring services rather than relying primarily on networking hardware cycles. Splunk offered exactly that kind of asset: a large software platform with recurring contracts, a strong developer ecosystem, and a position at the center of machine data used by security and operations teams. Cisco explicitly said the combination would accelerate its transformation toward more recurring revenue.

The investment targeted revenue quality as much as revenue growth

Recurring software can smooth hardware cycles, improve visibility into future cash flows, and raise the strategic value of customer relationships.

Splunk gave Cisco a common data layer for security and observability

Splunk built its franchise by indexing and analyzing machine-generated data from applications, infrastructure, security systems, and operational tools. That meant Cisco was not buying a single cybersecurity appliance. It was buying a platform used by security operations centers, application teams, and IT operations groups to investigate events across complex environments. Cisco’s acquisition announcement framed this as a way to move from threat detection toward prediction and prevention while combining networking telemetry with Splunk’s data platform.^[1] The value thesis was that network context becomes more useful when correlated with logs, application traces, identity signals, and security events.

The $28 billion headline translated to about $27.1 billion of accounting purchase consideration

The acquisition closed on March 18, 2024. Cisco’s completion announcement reiterated the approximately $28 billion equity value and said the deal would make Cisco one of the world’s largest software companies.^[2] In Cisco’s fiscal 2024 annual report, the accounting purchase consideration was about $27.1 billion after transaction mechanics, with $19.3 billion allocated to goodwill and $10.6 billion to acquired intangible assets.^[3] Those numbers show what Cisco believed it was buying: not factories or physical inventory, but customer relationships, technology, brand, and expected future synergies.

Goodwill represented the bet on combination value

The large goodwill balance reflects value Cisco expected from integration, cross-selling, and future growth that could not be assigned to individual identifiable assets.

Splunk immediately changed Cisco’s reported growth profile

In fiscal 2025 Cisco reported security product revenue of $8.1 billion, up 59%, with the increase driven primarily by offerings that included Splunk. Observability revenue increased 26% to about $1.06 billion, also driven largely by Splunk’s observability suite.^[4] The comparison includes acquisition effects, so it should not be read as purely organic growth. But it demonstrates the scale effect of the transaction: Cisco instantly became a much larger security and observability software vendor, reducing the relative weight of traditional routing and switching inside the company’s overall revenue mix.

The strategic integration connected network telemetry with software operations

Cisco and Splunk began integrating products rather than leaving Splunk as a financial holding. Cisco connected Splunk with products such as ThousandEyes, XDR, firewalls, identity systems, and network assurance tools. By 2025 Cisco was describing bidirectional integrations between Splunk Observability and ThousandEyes that connected application, infrastructure, and network context for faster troubleshooting.^[5] This integration is important because modern failures rarely respect organizational boundaries. A slow application may be caused by code, cloud infrastructure, DNS, an ISP, a security control, or a campus network.

The combined platform monetizes visibility across layers

If Cisco can connect network, security, and application data into one operational workflow, the acquisition can deepen customer dependence across multiple budgets.

The AI era strengthened the logic for buying machine-data infrastructure

AI systems generate enormous amounts of telemetry while also creating new security and reliability risks. Models, agents, APIs, vector databases, accelerators, and distributed inference services all need monitoring and threat detection. Splunk’s historical business was built around turning heterogeneous machine data into searchable operational context. That becomes more valuable as infrastructure gets more complex. Cisco’s later security announcements increasingly framed Splunk as part of an AI-era defense architecture in which telemetry is enriched, correlated, and acted on across the combined portfolio.

The investment risk is that integration can blur Splunk’s platform neutrality

Splunk succeeded partly because customers could ingest data from almost anything. Cisco gains the most strategic value if it integrates Splunk deeply with Cisco products, but too much preference for Cisco telemetry could reduce Splunk’s appeal as a neutral platform across heterogeneous environments. The company therefore has to balance cross-selling with openness. Cisco’s current Splunk integrations continue to support third-party data and open standards such as OpenTelemetry, which suggests management understands that ecosystem breadth is part of the acquired asset.^[5]

A neutral data layer can be more valuable than a captive feature

The more systems Splunk can observe, the more useful its analytics become, so preserving interoperability is directly tied to the acquisition’s long-run return.

Cisco bought a software operating layer for digital resilience

The Splunk deal can be understood as Cisco paying a premium to escape the limits of a hardware-defined identity. Networking remains central to Cisco, but security and observability increasingly determine whether digital systems are trusted and available. Splunk gave Cisco recurring revenue, a large software installed base, and a data platform that can connect events across applications, clouds, endpoints, and networks. Early reported results show a meaningful contribution to security and observability growth, while product integrations suggest the acquisition is being used strategically rather than managed as a standalone cash generator.^[4]

The unanswered question is whether Cisco can turn those assets into a unified platform without weakening Splunk’s independence and customer trust. If it can, the $28 billion price buys more than software revenue. It buys a control point over the data enterprises use to understand and defend their digital operations.

RESEARCH / PROVENANCE

Works Cited

5 SOURCES

1. 01
   Cisco — Cisco to Acquire Splunk ↗newsroom.cisco.com
2. 02
   Cisco — Cisco Completes Acquisition of Splunk ↗investor.cisco.com
3. 03
   Cisco — Fiscal 2024 Annual Report ↗investor.cisco.com
4. 04
   Cisco — Fiscal 2025 Form 10-K ↗sec.gov
5. 05
   Cisco — Splunk and ThousandEyes Integration ↗blogs.cisco.com

CodeHistory is a living archive. Citations document the evidence used for this edition; later evidence may refine the account.