Update timechart in SPL/PPL cheat sheet (opensearch-project#4382)

* Update timechart in SPL/PPL cheat sheet

Signed-off-by: Peng Huo <penghuo@gmail.com>

* Update

Signed-off-by: Peng Huo <penghuo@gmail.com>

---------

Signed-off-by: Peng Huo <penghuo@gmail.com>

Author: penghuo

docs/user/ppl/reference/splunk_to_ppl_cheat_sheet.md

@@ -55,15 +55,15 @@ This table provides a mapping between Splunk SPL commands and their OpenSearch P
 - PPL: ```source=`*` error failed status=500```
 
 **Aggregation:**
-- Splunk: `... | stats count BY host, status | sort -count`
+- Splunk: `... | stats count by host, status | sort -count`
 - PPL: `... | stats count() by host, status | sort - count`
 
 **Time-based query:**
-- Splunk: `... earliest=-7d | timechart span=1h count BY host`
-- PPL: `... | where timestamp >= date_sub(now(), INTERVAL 1 DAY) | stats count() by span(timestamp, 1h), host`
+- Splunk: `... | timechart span=1h count by host`
+- PPL: `... | timechart span=1h count by host`
 
 **Complex calculation:**
-- Splunk: `... | eval mb=bytes/1024/1024 | stats avg(mb) AS avg_mb BY host | where avg_mb > 100`
+- Splunk: `... | eval mb=bytes/1024/1024 | stats avg(mb) AS avg_mb by host | where avg_mb > 100`
 - PPL: `... | eval mb=bytes/1024/1024 | stats avg(mb) as avg_mb by host | where avg_mb > 100`
 
 ## Basic Search Syntax