[FEATURE] Unify the logic to lookup default time field

[ykmr1224]

Several PPL functions utilize default timestamp field @timestamp, but those are identified by separate logic.
We should refactor and unify the logic for better maintainability.

#4212
#4138

[RyanL1997]

Transferring from @anasalkouz : Also add the capability of handling other provided time field.