A distinguisher is a field in an event. A distinguisher is typically a hostname or IP address but can be any field.
You can use distinguishers to group multiple events referring to the same type of activity into a single alert instead of multiple alerts. For example, you create a rule that detects RAR files being transferred over the network, but you do not want an alert each time a RAR file is transferred from the same host. If you add srcipv4 (the source IP field) to the rule, then only one alert is generated for each host sending RAR files.
You can also use distinguishers to write a single rule that can generate multiple alerts. For example, if a rule includes two distinguishers – srcipv4 and dstipv4 – it will generate a unique alert for each combination of srcipv4 and dstipv4 when the rule hits.