How to use wildcard in lookup-based searches and alerts?

[the_wolverine]

I have a lookup table that contains Domains and URLs:

www.google.com/index.htm
www.blacklist.org/
www.facebook.com

Is there someway to craft a search that will allow a wildcard on both ends? For example, if there is a string of "www.blacklist.org" in my data, it will not match "www.blacklist.org/" in the lookup table (and vice versa.)

[gkanapathy]

right, you must include * in your data to indicate the location of a wildcard. You can include one or more in any place in the string, e.g., *.google.com/* is valid.

[the_wolverine]

The wildcard will not work without editing the lookup table to include *. For example:

www.google.com\*
www.blacklist.org\*

*Note that this is not documented.

[gkanapathy · Accepted solution]

You can specify

 match_type = WILDCARD(domain) WILDCARD(URL)

In the transforms.conf definition of your table. This works starting in version 4.2.

[the_wolverine]

Is there documentation on this method? I'm curious as to how granular the wildcarding is. In the case where my data contains domain=google.com, how is it determined how far in to match?