Acceptable XML time formats are established by ISO8601. One of them is just the same thing you have there, with a T instead of a space between the day and the hour. So, the easy way -- not technically proper, perhaps, but easy -- is to put a T where the space is.
Unfortunately, it also should be expressed in UTC, not a local time zone, so you'll need to use relative_time to adjust by whatever the local offset from GMT is. So, in actuality, you need to pull the time into epoch format, convert to GMT/UT, and then convert to ISO8601 time format. This could all be done in a single line, but I've presented the steps sequentially so that you can read it easier.
| eval EVENT_LOCAL_EPOCH = strptime(EVENT_LOCAL_TIME,"%Y-%m-%d %H:%M:%S.%1Q")
| eval myGMToffset="+5h"
| eval EVENT_UTC_EPOCH = relative_time(EVENT_LOCAL_EPOCH,myGMToffset)
| eval EVENT_ISO8601_TIME = strftime(EVENT_UTC_EPOCH,"%Y-%m-%dT%H:%M:%S.%1Q")
