Ask HN: What features do you like most and least (besides cost) about Splunk?

Everyone I've spoken to loves Splunk, but hates the price. If there were a cheaper alternative to Splunk, what are the features it would need to have before you'd ever considering switching? What are the features that could be improved?