Generally, one expects a client-server conversation to be greater on the download side rather than more data uploaded. This search can detect greater upload than download over a time period, like a client sending significantly more data than it receives from a server (e.g. data ex-filtration).
For the best search results, query on a sourcetype that contains bytes/bytes_in/bytes_out fields. The first two eval commands do the following: (1) create an upload and download field when upload bytes are greater than 5 times the download; (2) create a download field when download bytes are greater than 1.1 times the upload; (3) the else in both if statements is an empty string.
The second where command looks for uploads above a 2MB threshold for a sum of uploaded data.
The iplocation command identifies the geolocation details of the dest_ip field.
sourcetype=* AND bytes=* | convert timeformat="%m/%d/%Y %H:%M" ctime(_time) as timeMin | stats sum(bytes_in) as bytesIn sum(bytes_out) as bytesOut by timeMin src_ip dest_ip bytes | eval uploadDelta=if(bytesOut>bytesIn*(5), "upload", "") | eval downloadDelta=if(bytesIn>bytesOut*(1.1), "download", "") | table timeMin src_ip dest_ip bytesIn downloadDelta bytesOut uploadDelta | where (uploadDelta="upload") | stats sum(bytesOut) as uploadBytes sum(bytesIn) as downloadBytes by src dest | where uploadBytes>(2*1048576) | iplocation dest_ip | sort - uploadBytes | eval "uploadBytes_deltaFactor_5"=if($uploadBytes$>1073741824, tostring(round($uploadBytes$/1073741824,2))+" GB", if($uploadBytes$>1048576, tostring(round($uploadBytes$/1048576,2))+" MB", if($uploadBytes$>1024, tostring(round($uploadBytes$/1024))+" KB", tostring($uploadBytes$)+" B"))) | eval "downloadBytes_deltaFactor_1.1"=if($downloadBytes$>1073741824, tostring(round($downloadBytes$/1073741824,2))+" GB", if($downloadBytes$>1048576, tostring(round($downloadBytes$/1048576,2))+" MB", if($downloadBytes$>1024, tostring(round($downloadBytes_deltaFactor_10$/1024))+" KB", tostring($downloadBytes$)+" B"))) | fields - uploadBytes - downloadBytes - lon - lat - City