This seems to suggest that single wildcards at the end of a path should be valid. macOS 10.13, osquery 3.1.0