fixed an issue with regex and http packets. changed splunk_tcp which now works better on large pcaps