The best way would be to have the value enclosed in double quotes in the event like this:
UserFullName="Lastname, Firstname I."
Then Splunk will automatically extract the full value into the field.
What you do in rex
can be moved to the field extraction configuration.
What do you need eval
for?
I realize fixing the event logging is best, but that is something that takes time and a backlog item with development. I was looking for something with sed etc.. to extract and re-order fields. I am now using rex and eval, but as I stated earlier that seems the long way around.