Is your feature request related to a problem? Please describe.
Currently, PPL stats command support aggregation by span. But it doesn't support combine field and span, for example,
source=logs | stats max(cpu) by host, span(timestamp, 1d)

Describe the solution you'd like
we should revisit use cases and then decide how to support span/bin.

Describe alternatives you've considered
N/A