Here's a great way to search /aws/rds/cluster slowquery logs in CloudWatch for entries with a high "row examined" count:

parse @message "*Rows_examined: *\n*" as full, rows | display full, rows | filter rows > 200000 | fields @timestamp, @message | sort @timestamp desc | limit 20

Change "200000" to whatever threshold for rows you want to specify.