am i correct in assuming globbing is not supported...
# general
c
am i correct in assuming globbing is not supported in the extended_attributes table?
Copy code
osquery> select * from extended_attributes where directory='/Users/clong/Downloads';
+---------------------------------------------------------------------+------------------------+------------+-------------------------------------------------------------------------------------------------------------+--------+
| path                                                                | directory              | key        | value                                                                                                       | base64 |
+---------------------------------------------------------------------+------------------------+------------+-------------------------------------------------------------------------------------------------------------+--------+
| /Users/clong/Downloads/osquery-2.5.1_14_gc2d5bf1-1.linux.x86_64.rpm | /Users/clong/Downloads | where_from | <https://files.slack.com/files-pri/T08V7PM9C-F6260G1AA/download/osquery-2.5.1_14_gc2d5bf1-1.linux.x86_64.rpm> | 0      |
+---------------------------------------------------------------------+------------------------+------------+-------------------------------------------------------------------------------------------------------------+--------+

osquery> select * from extended_attributes where path like '/Users/clong/Downloads/%';