The best way would be to have the value enclosed in double quotes in the event like this:
UserFullName="Lastname, Firstname I."
Then Splunk will automatically extract the full value into the field.
I realize fixing the event logging is best, but that is something that takes time and a backlog item with development. I was looking for something with sed etc.. to extract and re-order fields. I am now using rex and eval, but as I stated earlier that seems the long way around.
What you do in
rex can be moved to the field extraction configuration.
What do you need