also my splunk fu is a little rusty atm, but not sure if you need both wildcards, if you go the wildcard route