different behavior from query_cfsan - returns DB keys, not cfsans