Use case SMB Traffic by bytes transfer

[splunkcol]

Hello, I need to create a use case that monitors the bytes transferred from one host to another, either by SMB or by another method, be it from the LAN or the WAN.

The log does not have any fields that refer to the size of the transferred data. How can I monitor these transfers from one host to another?

I have this base to adjust it to what I need or accept suggestions (font)

Thank you

index=* ((tag=network tag=communicate) OR (sourcetype=pan*traffic OR sourcetype=opsec OR sourcetype=cisco:asa OR sourcetype=stream* )) action=allowed (app=smb OR dest_port=139 OR dest_port=445)  | bucket _time span=1d | stats count by _time src_ip dest_ip dest_port

[richgalloway]

If the data does not include a byte count or some other size indication then Splunk cannot use size as a monitoring criteria.

[isoutamo]

Just like @richgalloway said, you cannot calculate exact traffic without size information on logs. Of course you could calculate estimate of maximum traffic based on event count * max size of event, but probably this is not what you are looking for?
R. Ismo

[splunkcol]

@isoutamo  The method you suggest, I don't mind if you don't tell me how many bytes or Gygabytes were transferred, but it would help me if you alert me if there is abnormal traffic from one host to another.

I need to prevent possible information leakage

When you talk about event count, do you mean the number of events from one host to another?

If so, I would appreciate how the query would be.

thank you