| eval stime=strftime(strptime(stime,"%FT%TZ"),"%F %T")
| eval etime=strftime(strptime(etime,"%FT%TZ"),"%F %T")
| eval orgstime=strftime(strptime(orgstime,"%FT%TZ"),"%F %T")
| eval orgetime=strftime(strptime(orgetime,"%FT%TZ"),"%F %T")
As I noted in https://community.splunk.com/t5/Splunk-Search/Date-time-formatting-variables-not-producing-result-I-..., the letter "Z" signifies a standard time zone and you should NOT simply remove it. Instead, Splunk should process it as a timezone token before you render the end result in any string format you wanted. In other words,
| eval stime=strftime(strptime(stime,"%FT%T%Z"),"%F %T")
| eval etime=strftime(strptime(etime,"%FT%T%Z"),"%F %T")
| eval orgstime=strftime(strptime(orgstime,"%FT%T%Z"),"%F %T")
| eval orgetime=strftime(strptime(orgetime,"%FT%T%Z"),"%F %T")
| makeresults
| eval time="2023-11-01T15:54:00Z"
| eval reformatted=strftime(strptime(time,"%FT%TZ"),"%F %T")
This is the final stats results I got it now. The query you have shared is used to modify specific time. But I like to modify the timestamp on all the below mentioned column.
| eval stime=strftime(strptime(stime,"%FT%TZ"),"%F %T")
| eval etime=strftime(strptime(etime,"%FT%TZ"),"%F %T")
| eval orgstime=strftime(strptime(orgstime,"%FT%TZ"),"%F %T")
| eval orgetime=strftime(strptime(orgetime,"%FT%TZ"),"%F %T")