You could take every other (or some number) event using the modulo operator. | where (_time % 2 = 0) ... View more