Is there a way to reassemble the original file which was sent via http, smtp, or ftp protocol?
If it is possible, how can we do that?
If not, is there alternative ways or complementing solutions for that?
Thank you.
The current version of Stream doesn't reassemble the files sent via FTP/SMTP/etc. Stream does support extracting data from HTTP payload via regular expressions, so it may be feasible to create (clone) a HTTP stream that filters events based on http_content_type field (to, say, start with application/) and cuts off response headers from the dest_content field using content extraction regex (see http://docs.splunk.com/Documentation/StreamApp/6.3.2/DeployStreamApp/ConfigureStreams#Use_Content_Ex...)
