To address this, I opened ticket https://redmine.openinfosecfoundation.org/issues/904. Once that is completed, the proper TX can be selected reliably.