FQL does not work correctly with wildcards

[zjuka]

Hello,

I'm using FalconPy to get data from Discovery module and trying to use wildcard, but it does not return any result in resources field.
Code:

hostname = 'EEW'
    response = falcon.query_hosts(
                                  filter=f"hostname:'{hostname}*'")['body']

Result:
{'meta': {'pagination': {'limit': 100, 'offset': 0, 'total': 0}, 'powered_by': 'discover-api', 'query_time': 0.033183413, 'trace_id': '9f8e02fe-beb5-4206-8a78-7c7f44cd4f22'}, 'resources': []}

If I will use hardcoded value in 'hostname' - it will work as expected
Code:

hostname = 'EEW2'
    response = falcon.query_hosts(
                                  filter=f"hostname:'{hostname}'")['body']

Result:
{'meta': {'pagination': {'limit': 100, 'offset': 0, 'total': 1}, 'powered_by': 'discover-api', 'query_time': 0.077847164, 'trace_id': '189d1e4f-d96a-4a3e-baf7-c80c7385420c'}, 'resources': ['2123501d70a146879bf8fb0208f76945_345960475851664375']}

Could you please explain why wildcard does not work in this case?

BR
Artur

[jshcodes]

Hi @zjuka -

This seems a little counter-intuitive, but add another asterisk before your first single quote to hint that you are passing a wildcard.

response = falcon.query_hosts(filter=f"hostname:*'{hostname}*'")['body']

Thank you for pointing out this documentation gap! I'll make sure our FQL page gets updated to properly reflect this usage quirk. 😄

[zjuka]

Hi @zjuka -

This seems a little counter-intuitive, but add another asterisk before your first single quote to hint that you are passing wildcard.

response = falcon.query_hosts(filter=f"hostname:*'{hostname}*'")['body']

Thank you for pointing out this documentation gap! I'll make sure our FQL page gets updated to properly reflect this usage quirk. 😄

Thank a lot, now working as expected.