This is intentional.
In Splunk when you define a regular expression to extract a field, it has to "bind", or apply, to a source, a sourcetype, OR a host. So when you define a regex, it's going to apply to all the events of that source, sourcetype, or host (from which ever one you binded the regex), and not just the 15 that have the "connected from" text. As a result, we want you to see the effect of your regex on all the events it will apply to. If you only see the 15 events you have in mind, you'll not see the potentially disastrous effects it will have on other events.
That said, in the Field Extractor app, you can filter your events to just those that have a particular string (e.g., "connected from"), so that you can see the big picture and also focus in on particular events.
... View more