Here’s a great way to search /aws/rds/cluster slowquery logs in CloudWatch for entries with a high “row examined” count:

parse @message "*Rows_examined: *\n*" as full, rows
| display full, rows
| filter rows > 200000
| fields @timestamp, @message
| sort @timestamp desc
| limit 20

Change “200000” to whatever threshold for rows you want to specify.