^ I wouldn't argue with that at all. NOW has a massive moat since it gets so tied into IT operations and the automation/customization benefits are huge. But Splunk definitely has a moat. Trying to make sense of billions of security and operational events into something that makes sense is a massive problem for IT departments. These types of tools have been around forever, but Splunk's ability to tie many of these collector tools together and generate meaningful information makes it the leader. Once you do that, you find more to do, and like NOW - it's not going to get ripped out. Most Splunk customers seem to double/triple their initial usage within a year or so. So I think a few years from now - like NOW and Palo Alto - Splunk will have enough critical mass with it's sales force and total offering (acquisitions) that they will be the undisputed leader. We will see. I might be too early, as that seems to be my curse.
Splunk is undergoing a switch in their pricing model from data based pricing to usage based, as well as cloud enablement. Most of the users hated the data pricing, as you loaded up your data and paid for that regardless of processing. Now you can load all you want - and pay for what you process. This should make it much easier for companies to see what SPLK can do for them - and just pay for that. You'll see Splunk usage skyrocket in my opinion. Add the cloud enablement in, and that will make it easier for many companies to get started with Splunk.
So, yeah, it's expensive - but this pricing model change slows revenue growth down in the short term (1-2yrs?) and hence the hit to the stock.