The union of the left side operation output set and the right side operation output set. The resulting output set contains events from either the left-hand side operation output set or the right-hand side operation output set without duplicates.
For example:
filter(e.sev = 5) union filter(e.sip = 192.168.0.1)
is equivalent to
filter(e.sev = 5 or e.sip = 192.168.0.1)