Riverbed Pilot[0] (or whatever it's called now) may be what you're looking for. It works incredibly well to help drill down the haystack, and then export that particular part to Wireshark. Do like.

[0] https://www.riverbed.com/gb/products/steelcentral/steelcentr...