It's a tad clunky, but as long as you want to sort by _time, there's a way to do it with streamstats:
| eval low=3
| eval high=4
| streamstats count as NewToOld
| head(NewToOld<=high)
| reverse
| streamstats count as OldToNew
| head(OldToNew<=high-low+1)
| reverse
Streamstats will basically index your events for you and then through a little mathematical manipulation, you can use head and tail (or in this case, reverse & head) to chop off either end of the results leaving only the desired middle results. Note that this will only work if you're looking for the middle results by the order Splunk found them (which is the same as _time as long as you don't have any appended results).
... View more