I have a CSV file that lines up fields perfectly in Excel, but when Splunk parses that same CSV data, it gets tripped up when it gets an event with an extra comma in it, even if each field is encapsulated with "quotes" like this:
"5/1/2012 12:15:43 AM","GeneralHostWarningEvent","warning","","USLAB1","Compute HCS","Issue detected on uslab1esxi04, reboot host."
See in the last field, there is a comma before reboot host. This is where Splunk ends that field and then events after this get misaligned.
Is this a bug that should be fixed, or am I going to need to backfill all my data with a force dimlimiter of some other character other than a comma?