diff --git a/salt/common/tools/sbin/so-zeek-logs b/salt/common/tools/sbin/so-zeek-logs
index 0e74e54bf..551213580 100755
--- a/salt/common/tools/sbin/so-zeek-logs
+++ b/salt/common/tools/sbin/so-zeek-logs
@@ -2,26 +2,11 @@
 local_salt_dir=/opt/so/saltstack/local
 
 zeek_logs_enabled() {
-
   echo "zeeklogs:" > $local_salt_dir/pillar/zeeklogs.sls
   echo "  enabled:" >> $local_salt_dir/pillar/zeeklogs.sls
   for BLOG in "${BLOGS[@]}"; do
     echo "    - $BLOG" | tr -d '"' >> $local_salt_dir/pillar/zeeklogs.sls
   done
-
-}
-
-whiptail_check_exitstatus() {
-	case $1 in
-		1)
-			whiptail --title "Security Onion Setup" --msgbox "Cancelling. No changes have been made." 8 75
-      exit
-			;;
-		255)
-			whiptail --title "Security Onion Setup" --msgbox "Whiptail error occured, exiting." 8 75
-			exit
-			;;
-	esac
 }
 
 whiptail_manager_adv_service_zeeklogs() {
@@ -66,8 +51,23 @@ whiptail_manager_adv_service_zeeklogs() {
   "x509" "x.509 Logs" ON 3>&1 1>&2 2>&3 )
   
   local exitstatus=$?
-  whiptail_check_exitstatus $exitstatus
+
+  IFS=' ' read -ra BLOGS <<< "$BLOGS"
+
+  return $exitstatus
 }
 
 whiptail_manager_adv_service_zeeklogs
-zeek_logs_enabled
+return_code=$?
+case $return_code in
+  1)
+    whiptail --title "Security Onion Setup" --msgbox "Cancelling. No changes have been made." 8 75
+    ;;
+  255)
+    whiptail --title "Security Onion Setup" --msgbox "Whiptail error occured, exiting." 8 75
+    ;;
+  *)
+    zeek_logs_enabled
+    ;;
+esac
+