Intersection Operator

The intersection of the left side operation output set and the right side operation output set. The resulting output set contains events that are common in both the left-hand side operation output set and the right-hand side operation output set without duplicates.

For example:

filter(e.sev = 5) intersection filter(e.sip = 192.17.16.32)

is equivalent to

filter(e.sev = 5 and e.sip = 192.17.16.32)