There were some great sessions at .conf2017 that could help you learn some basic SPL
http://conf.splunk.com/sessions/2017-sessions.html
One I'd recommend is Power of SPL, the recording isn't up but the slides are.
there is also this doc that can help you understand a bit of the linguistics
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/UnderstandingSPLsyntax
To get to your question, however.
in host = x OR host = y
you will retrieve data from both y and x hosts.
you can also use OR in eval statements, such as |eval newhost=if(host = x OR host = y,"xy",host)
would create a field called newhost with values xy when the host is either x or y, otherwise the value would be any other host value.
OR can also be used in where and search statements.
to elaborate, i'll answer your second part:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where?r=searchtip
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Searchwhere
can be used to eliminate fields that don't match certain criteria, as can the search command.
The difference between where
and search
, in my opinion, is that search is best for field to value comparisons and where is better for field to field comparisons (or evaluating a field and comparing it to a value). you can see examples in the links I supplied.
the SQL where and the SPL where/search generally do the same thing, the only difference should be the syntax.