Well, if string a and string b are actual strings (not regular expressions), then this will work
"a" OR "b"
It would be nice to include a sourcetype, source, etc. in the above search, to make it more targeted and efficient. If the strings are regular expresssions, then use this:
yoursearchhere
| where match(_raw,"a") OR match(_raw,"b")
In this case, you will have to write some search that retrieves a set of data before applying the regular expression filter. While you could use the regex command instead of the where command, I often find this way easier. With regex, you need to write a single regular expression. Combining "a" and "b" might be difficult or hard to understand.
