user fields contains comma in value. Best way to have field value include first and last name?

[ericrobinson]

My field in the events is as follows

UserFullName=Lastname, Firstname ,

I know that I can use a regex to extract the fields and concantenante the fields using eval to create a new fullname field. That just seems a long way around.

Thanks.

[martin_mueller]

The best way would be to have the value enclosed in double quotes in the event like this:

UserFullName="Lastname, Firstname I."

Then Splunk will automatically extract the full value into the field.

[martin_mueller]

What you do in rex can be moved to the field extraction configuration.

What do you need eval for?

[ericrobinson]

I realize fixing the event logging is best, but that is something that takes time and a backlog item with development. I was looking for something with sed etc.. to extract and re-order fields. I am now using rex and eval, but as I stated earlier that seems the long way around.