Splunk India Equity Guide: The Cisco Acquisition & Your SPLK/CSCO Stock

Splunk India: Offices, Scale & Acquisition Context

Splunk India was one of the largest cybersecurity and data analytics engineering centres in the country. Hyderabad was the primary India hub with approximately 3,000 employees — building core Splunk platform components including the Splunk Enterprise search and indexing engine, Splunk Cloud, Splunk SOAR (security orchestration and automation), and the IT Service Intelligence (ITSI) product. Bengaluru contributed roughly 1,500 employees, concentrated on Splunk Cloud infrastructure, developer tools, and UBA (User Behavior Analytics). Pune had approximately 500 employees in operations and support.

Cisco announced the Splunk acquisition in September 2023, and the deal closed March 18, 2024. At $157/share, it was one of the largest cybersecurity acquisitions in history. Cisco's stated strategic rationale: combining Splunk's data observability and security analytics with Cisco's networking infrastructure to create an integrated "security and observability" platform.

For Splunk India employees, the transition has been substantial. Hyderabad and Bengaluru teams were incorporated into Cisco's security and observability business unit. Most engineering teams were retained — Cisco explicitly stated it wanted Splunk's product engineering talent. Integration with Cisco's existing security portfolio (Talos threat intelligence, SecureX, Cisco Identity Services Engine) is the ongoing work.

Some rationalisation occurred in overlapping functions — particularly in sales, marketing, and G&A where Cisco had existing India presence. But the engineering centres are largely intact as of 2025-2026.

• →Hyderabad (~3,000): Splunk Enterprise, Splunk Cloud, SOAR, ITSI — now Cisco Security/Observability
• →Bengaluru (~1,500): Cloud infrastructure, developer tools, UBA
• →Pune (~500): Operations and support
• →All-cash acquisition at $157/share, closed March 18, 2024
• →Most engineering retained; G&A and sales saw more integration rationalisation

What Happened to Your SPLK Shares & RSUs at Close

The Cisco-Splunk acquisition was an all-cash deal: $157 per SPLK share. No stock component. This means:

Vested SPLK shares in your brokerage: automatically converted to $157 cash per share on March 18, 2024. If you held 300 vested SPLK shares, you received $47,100 to your brokerage account.

Unvested SPLK RSUs: converted to Cisco RSUs at an exchange ratio based on the relative trading prices of SPLK ($157) and CSCO at close. The conversion ensured the economic value of your unvested position was preserved in CSCO shares. The converted CSCO RSUs continue vesting on the same schedule as your original SPLK RSUs.

For employees in the context of the September 2023 announcement to March 2024 close period: SPLK traded close to $157 during this period (reflecting the certainty of close and the all-cash deal). Employees who sold vested SPLK in this window received approximately $157. Employees who held through close received exactly $157 in cash.

Some leadership and senior employees received retention bonuses or modified equity packages as part of the Cisco integration. If you signed a retention agreement, check the specific terms for any accelerated vesting or cash retention provisions.

• →Vested SPLK shares: $157/share cash, converted automatically at close March 18, 2024
• →Unvested SPLK RSUs: converted to CSCO RSUs at exchange ratio — continue vesting on original schedule
• →SPLK traded near $157 during deal period (Sep 2023 - Mar 2024) — vested holders who sold early also got ~$157
• →Retention agreements: some senior employees received special retention provisions — check your agreement

Tax Treatment of the $157 Cash Buyout

The $157/share received for vested SPLK shares is a capital gains event in India, reportable in FY 2023-24 (deal closed March 18, 2024 — within Indian FY 2023-24 ending March 31, 2024).

Your cost basis per SPLK lot is the FMV of SPLK on the vest date for each lot (the price used when perquisite tax was paid at vest). The capital gain per share is $157 minus that FMV, converted to INR at the SBI TT buying rate on March 18, 2024 (the close date).

LTCG vs STCG classification: - Shares vested more than 24 months before March 18, 2024 (i.e., vested before March 18, 2022): LTCG — 20% with indexation, or 12.5% for listed securities under Budget 2024 rules. - Shares vested within 24 months of March 18, 2024 (vested after March 18, 2022): STCG at slab rate (30%+).

Splunk's stock had meaningful appreciation for long-tenured employees. For an engineer who joined in 2019-2020 with SPLK grants vesting at $80-$100 FMV, the gain to $157 on LTCG-eligible lots represents a 57-97% gain, taxed at 20% — still a substantial profit.

For employees who had unvested SPLK RSUs converted to CSCO RSUs: no tax event occurred at conversion. The conversion was a structural change, not a vest event. Perquisite tax will apply when those CSCO RSUs actually vest.

FY 2023-24 ITR is the critical year. If you received $157 cash for SPLK shares in March 2024, that capital gains income must appear in your FY 2023-24 ITR. With the typical filing deadline (July 31, 2024 without extension, December 31, 2024 with extension), this should have been filed. If not, consult a CA for a revised return.

• →$157/share cash = capital gains event in FY 2023-24 (deal closed March 18, 2024)
• →Lots vested before March 18, 2022: LTCG — 20%/12.5%
• →Lots vested after March 18, 2022: STCG at slab rate (30%+)
• →SPLK-to-CSCO conversion of unvested RSUs: no tax event at conversion — perquisite applies at CSCO vest
• →FY 2023-24 ITR must include this event — file revised return if omitted

Your New Cisco (CSCO) RSU Package

If you are a retained Splunk employee now at Cisco, you hold converted CSCO RSUs (from your unvested SPLK position) plus potentially new CSCO RSU grants as part of your Cisco compensation package.

Cisco (CSCO) is one of the world's largest networking and cybersecurity companies. CSCO is traded on NASDAQ and is a Dow Jones Industrial Average component. It is a large-cap, dividend-paying, mature technology company — quite different from Splunk, which was a fast-growing, high-multiple software company.

CSCO's equity compensation structure: Cisco uses restricted stock units with quarterly vesting (typically) and a 1-year cliff. Cisco's fiscal year ends July 31. Refresh grants are issued annually based on performance reviews.

The grant sizes at Cisco are calibrated to a mature enterprise tech company — more conservative than Splunk's startup-culture equity packages. Senior software engineers receive grants in the $60,000-$120,000 range over 4 years. Staff and Principal levels see $120,000-$220,000. Directors and above: $250,000-$500,000.

CSCO trades at a lower earnings multiple than Splunk did — it's valued as a mature technology company with steady cash flows and a growing dividend, not a high-growth security analytics platform. This means the upside potential in CSCO is more modest, but so is the downside volatility.

• →CSCO ticker: NASDAQ — Dow Jones component, mature large-cap tech
• →Converted unvested SPLK RSUs: now CSCO RSUs at adjusted share count, vesting on original schedule
• →New CSCO grants: quarterly vest, 1-year cliff, 4-year vest period
• →CSCO fiscal year: ends July 31 — refresh grants issued August-October annually
• →CSCO is a dividend payer (~2.5-3% yield) — unlike SPLK which paid no dividend

The Tax Reality for Cisco (Former Splunk) Employees

For ongoing CSCO RSU vests (both converted and new grants): standard Indian RSU tax framework applies. At each vest event, the FMV of CSCO (NASDAQ closing price on vest date × SBI TT rate) is perquisite income under Section 17(2), taxed at slab rate. Cisco India handles withholding via sell-to-cover.

Capital gains on CSCO shares sold: LTCG after 24 months from vest date (20%/12.5%); STCG within 24 months at slab rate. CSCO is NASDAQ-listed — foreign listed security treatment applies.

CSCO pays a quarterly dividend (currently ~$0.40/quarter, ~$1.60/year). US withholding rate for Indian residents: 25% (India-US DTAA). File Form 67 annually to claim this credit. On 500 CSCO shares at ~$20/share, the annual dividend is approximately $800 — after 25% withholding, you receive $600, but you can reclaim the $200 withholding via Form 67. Over 5 years, that's ₹80,000-₹1 lakh in recoverable withholding.

Schedule FA: declare CSCO shares in Schedule FA annually. With CSCO at ~$20/share, 1,000 shares = approximately $20,000 = ₹16-17 lakh — potentially above the ₹20 lakh threshold for detailed Schedule FA reporting at larger positions.

• →Ongoing CSCO vests: perquisite at CSCO FMV × SBI TT rate, withheld at vest
• →Sale: LTCG (20%/12.5%) if 24+ months; STCG at slab if within 24 months
• →CSCO dividend: $1.60/year/share — 25% US withholding, claim via Form 67 annually
• →Schedule FA: CSCO shares above ₹20L in value must be declared
• →SPLK $157 event in FY 2023-24: must be in that year's ITR, separate from CSCO ongoing

What Splunk/Cisco India Employees Are Doing With Their Shares

The $157 SPLK cash event was a forced liquidity moment. Most Splunk India employees repatriated a meaningful portion to India after paying the applicable capital gains tax, and deployed it into diversified investments — Indian equity mutual funds, NPS top-up, real estate deposits, or US index funds via LRS.

For CSCO RSUs going forward, the typical approach is a split: sell a portion at vest for immediate liquidity and diversification, hold a portion for LTCG qualification. CSCO's lower volatility compared to SPLK makes the hold-for-LTCG calculation less risky — waiting 24 months for CSCO is less volatile than waiting 24 months for Splunk was.

The psychological transition from Splunk (a high-energy, fast-moving security analytics company) to Cisco (a mature, process-oriented enterprise technology company) has been real. Some Splunk India engineers thrive in Cisco's structure; others find the integration slow and hierarchical. Departure rates in the first year post-acquisition were moderate — particularly among Splunk's most senior individual contributors who were offered significant equity at competing companies.

• →$157 SPLK cash: most employees diversified — index funds, NPS, real estate deposits
• →CSCO RSUs: sell-some-hold-some at vest; CSCO's low volatility makes LTCG hold more manageable
• →Cultural transition: Splunk's startup velocity vs Cisco's enterprise process — affects retention
• →Post-acquisition departures: moderate — primarily senior ICs who got strong competing offers

The Smart Approach to Your CSCO Holdings

Managing CSCO RSUs requires a different framework than Splunk. CSCO is a reliable dividend-payer and a steady compounder — not a high-growth security analytics platform. Set expectations accordingly: 8-12% annual return is a reasonable base case for CSCO, not 25-30%.

For each CSCO vest (both converted SPLK-to-CSCO lots and new grants), run the standard LTCG vs STCG analysis. CSCO's lower volatility means the hold-for-24-months calculation is more straightforward: the risk of the stock declining significantly while you wait for LTCG qualification is lower than with high-beta tech stocks.

CSCO's dividend is a feature, not a bug. For investors who want regular income from their equity holdings, CSCO's growing dividend (Cisco has raised its dividend consistently) provides cash flow without needing to sell shares. Use the dividend income strategically — file Form 67 every year to claim the US withholding credit.

Cap total CSCO + unvested at 20-25% of investable net worth. CSCO's defensive quality means the concentration risk is lower than with growth stocks, but it's still a single company. Diversify excess into Nifty index funds and US total market funds.

• →CSCO is a steady compounder (~8-12%/year expected) — calibrate expectations from Splunk's growth profile
• →LTCG hold: lower risk with CSCO than with Splunk — more predictable price, easier to wait 24 months
• →Dividend: claim Form 67 credit annually — ₹16,000-₹40,000/year recoverable depending on holding size
• →Cap CSCO + unvested at 20-25% of net worth — defensive quality but still single-stock risk
• →Diversify into Nifty50 index funds (INR) and US total market ETF (USD via LRS)
• →Track SPLK-origin lots separately — their cost basis and LTCG clock differ from new CSCO grants

Concentration Risk at Cisco

CSCO is a lower-concentration-risk stock than Splunk was. Cisco's diversified revenue base (networking, security, collaboration, cloud management), strong balance sheet, and consistent free cash flow generation make it more stable than a pure-play growth company. CSCO's beta is approximately 0.9 — slightly less volatile than the market.

The risk for Cisco India specifically: Cisco has a history of making large acquisitions and then spending years integrating them with mixed results. The WebEx acquisition, the AppDynamics acquisition, and now Splunk — integration complexity is Cisco's recurring challenge. If the Splunk integration underperforms expectations, CSCO's revenue growth could disappoint, affecting the stock.

For Splunk India employees specifically: your Hyderabad and Bengaluru teams are now part of Cisco's security and observability business unit. If this unit underperforms within Cisco's portfolio, headcount decisions could follow. The employment risk is real but lower than at a standalone company with funding dependence — Cisco's overall business will sustain operations even if one unit underperforms.

Your salary from Cisco India + your CSCO RSUs = correlated but lower-severity concentration risk than at a pure-play startup or high-growth company.

• →CSCO beta ~0.9: less volatile than market — lower concentration risk than high-growth tech
• →Acquisition integration risk: Cisco's track record with large acquisitions is mixed — Splunk integration is being watched
• →Employment risk at former-Splunk India: moderate — Cisco's overall business sustains operations even with unit underperformance
• →Salary + CSCO RSU correlation: real but lower severity than Splunk standalone concentration was

Getting Money Home: FX & Repatriation

For the $157/share SPLK cash proceeds: these USD amounts needed repatriation via inward wire to India. Standard Indian bank FX spreads (1.5-2.5%) apply. On a $50,000 SPLK payout, FX cost at a typical bank is ₹60,000-₹1 lakh. Rovia's zero-markup FX saves this cost. Capital gains tax on SPLK proceeds must be paid before repatriation of large amounts; Form 15CA and Form 15CB required above ₹50 lakh.

For ongoing CSCO dividends and RSU sale proceeds: quarterly dividends can be aggregated and repatriated annually. CSCO pays ~$1.60/share/year. On 500 CSCO shares, that's $800/year — wire this together with any share sale proceeds to minimise fixed wire costs.

CSCO share sales generate USD proceeds in your US brokerage. Capital gains tax (self-assessed) must be paid in India for the applicable quarter's advance tax installment before you repatriate. Do not wait until ITR filing to pay capital gains tax on CSCO sale proceeds — advance tax interest accumulates from the quarter of sale.

CSCO Stock Sentiment & What Former Splunk Employees Are Watching

Cisco stock sentiment among former Splunk India employees is pragmatic rather than excited. CSCO has been a steady performer — not a fast mover. The Splunk acquisition has added a security analytics story to CSCO's narrative, and management has emphasised the combined security and networking opportunity. But CSCO's trading multiple reflects its maturity — investors are not pricing in a Splunk-era growth trajectory.

The key catalysts employees monitor: Cisco's quarterly security revenue (specifically Splunk-derived ARR within Cisco's reporting), the pace of Splunk product integration into Cisco's security platform, and any news about how the combined Cisco-Splunk SIEM and observability product is performing against competitors like Palo Alto Networks Cortex, Microsoft Sentinel, and CrowdStrike.

For the India engineering teams, the day-to-day is more focused on product delivery than stock price. The Hyderabad Splunk centre is large enough that it functions somewhat autonomously within Cisco — it doesn't feel like a complete cultural merger. Engineers describe the experience as working at "Splunk within Cisco."

The departure calculus for Splunk India engineers: the CSCO equity package is solid and reliable, but some engineers who joined Splunk for the startup culture and fast career progression have found Cisco's larger-company pace slower. Competitors — including Palo Alto Networks, CrowdStrike, and Elastic — have been recruiting actively from Splunk India's talent pool.