Splunk Stream pcaps path

[badrsplunk]

Hi,
I'm deploying splunk stream with an independent forwarder and an external NFS share +(two indexers+search head splunk_stream app). The objective was to capture and reference http flow of a specific web application (for traceability purpose). due to that, the main concern will be the ability to download pcap files but only indexing small events (_time, src_ip, desti_ip, pcap-url). However, in my tests, i couldn't find any pcap-url or path fields in my http flow events (stream:http).
How can i handle this?

Best Regards

[badrsplunk]

Hi Again,
The stream_app provide pcap download action, under event actions check box. That will automatically download the pcap from the fileserver.
Happy splunking..