I'm deploying splunk stream with an independent forwarder and an external NFS share +(two indexers+search head splunk_stream app). The objective was to capture and reference http flow of a specific web application (for traceability purpose). due to that, the main concern will be the ability to download pcap files but only indexing small events (_time, src_ip, desti_ip, pcap-url). However, in my tests, i couldn't find any pcap-url or path fields in my http flow events (stream:http).
How can i handle this?