Worked for a company that used Splunk... I was told to log less.

That was real strange coming from Amazon, where I was told to log anything and everything... And often, without the logs, it would have been impossible to determine root cause of some issues.

The difference was that logging was super cheap at Amazon, because we'd store all the data, but no indexing on the contents of logs.

If your service is small, or if you are only interested in logs for a specific hosts, you could download, and grep through it... Or run some sort of mapreduce jobs against it. But that was a long time ago. Surely they have better tooling now.