Stream does not store packets (this is a very common misconception). Instead it generates events derived from the data contained in the packets. It has extensive capabilities for filtering, aggregation, etc. that limit and control the events it generates so that you don't have to store any more data than you want. If you're trying to get events into Splunk from wire data (or network traffic), Stream is (almost*) always the best way to do it.
*The only exceptions I can think of is when you already have another system in place generating the data you want, for example you only want NetFlow data (a small subset of what stream provides), and you already have a switch in place that generates this data for you. In this case (and assuming there is already an Splunk app available, as there is for NetFlow data), it may be easier to go that route versus using Stream.
