Starboard's margin push led Splunk to a $28B all-cash sale to Cisco

Splunk entered 2022 in transition: CEO Doug Merritt stepped down in November 2021, Proofpoint founder Gary Steele took over, and the data-analytics pioneer was growing 17% a year with an 11% operating margin against software peers at 26%. In February 2022, when Splunk was worth $18.4 billion, Cisco offered more than $20 billion and the approach went nowhere. By November 2022 the stock had slid to $85.67 and a $13.9 billion market cap.

In October 2022 Starboard Value disclosed a stake of just under 5%. Its math was public: Splunk's combined growth-plus-margin score of 28 sat against a peer median of 47, and closing even half the gap would, Starboard argued, double the valuation. The fund noted Splunk's software was mission-critical for roughly 22,000 customers, including 95 of the Fortune 100, so this was a company to fix, not abandon.

The pressure held for a year. Splunk added two independent directors in October 2022 and began cutting costs. On September 20, 2023 Cisco signed a merger agreement at $157.00 a share in cash, about $28 billion, approved unanimously by the board. Hellman & Friedman, which had paid $116 a share for 7.5% in March 2022, locked in a 35% return; Starboard's remaining 2.46% stake was worth about $628 million at the deal price.

Cisco paid $157 a share in cash, 83% above the $85.67 Splunk fetched before the campaign; Splunk had brushed off a $20B-plus Cisco offer in February 2022.

The thesis was public and testable: 17% growth plus an 11% margin against peers at 26% named the exact gap in the business.

Splunk's product was mission-critical for 22,000 customers including 95 of the Fortune 100, so the asset was worth fixing rather than abandoning.

Cisco had already offered more than $20 billion in February 2022; the activist campaign reset the price at which that deal finally made sense.

A new CEO installed in March 2022 meant Starboard could push operational change without first having to win a board fight.

A public, testable activist thesis can set a price floor: once Starboard argued margins could double, the company became worth more to a strategic buyer than to the stock market.

The merger closed on March 18, 2024, and Splunk became the centerpiece of Cisco's security and observability strategy. Days before closing, Splunk cut about 500 staff, 7% of its workforce, completing the cost reset Starboard had demanded. Starboard had trimmed to a 2.46% stake by June 2023 yet still held roughly $628 million worth at $157 a share. The episode became the template for activist stakes that end in a sale: when Starboard turned up at Dynatrace with the same playbook in 2026, commentators immediately framed it as a setup for a Splunk-style exit.