Yep, this is what was causing the hang on edit user that I noted. It happens on subsequent runs since we dont know that splunk is already configured.