The PCAP does not transfer to Splunk, however there is an event field link within the analysis dashboards that will take you to that event and allow you to download the PCAP. This works even if the pivot is to a CM appliance because the CM appliance will pull the PCAP from the LMS appliance and still make it available. From the Splunk app, navigate to the LMS analysis page. For example NX Analysis. Click the event in question A details panel should appear below the events The far right link will be an event link that will pivot you back to the appliance to see that event Click that and authenticate if necessary and you can download the PCAP there Hope that helps. ... View more