Is there something wrong with regex and dest_content filters in Splunk App for Stream?

[heath]

We're testing Splunk App for Stream. If I go into Streams Config and clone the http stream then add a regex dest_content filter to the cloned stream it seems to ignore the filter and capture all data. As though it's ignoring the regex value. If I switch it from "Regular Expression" to "Contains" in the filter it works as expected. Regex seems to work fine for other fields like uri, just not the dest_content.

Here's the filter:
Term: http.sc-content
Comparison: Regular Expression
Value: anystring
Match All: Checked
I have Match Filters set to All.

With this set, it captures all data (and puts us over our license again).

[csharp_splunk · Accepted solution]

Yes. Sorry you had to find this, but yes it is broken. It will be fixed hopefully in the next minor version (6.2).

[heath]

It would probably be good to add this one to the known issues. I spent some time trying to figure out what I was doing wrong. Is there an eta for 6.2?

Thanks!

[mdickey_splunk]

This bug has been fixed in release 6.2.0, available as of today: https://apps.splunk.com/app/1809/

[heath]

Nice, thanks for the update. We'll try it out.