Regarding Rollback deleted records by using condition created on

[sivakumaraa]

Hi,

My question is how to retrieve the deleted records in incidents by using condition created on. But we need to use server side script like fix or background script, can you please give suggestion how to write script.

This is my script:

var del = new GlideRecord('sys_audit_delete');

del.addQuery('sys_updated_on', 'ON ', '2026 - 05 - 20 ');

del.query();

while (del.next()) {

    var rollback = new GlideRollback();

    rollback.rollbackSequence(del);

    gs.print('Rolled back sequence: ' + del.sys_id);

}

gs.print(' Error Rolled back sequence: ' + del.sys_id);

can you please modify and update the script

[Tanushree Maiti]

Hi @Ankith Sharma 

It is always recommended to add a validation step to confirm that the expected records are being identified before performing major operations such as Delete or Update.

In my project(s), I have never used a script for undelete operations. Whenever restoration was required, I restored the records manually by navigating to the appropriate path.

This approach allows you to first identify and verify the records before restoring them, effectively serving as a manual validation step.

[Ankith Sharma]

Thank you for the clarification @Tanushree Maiti . I completely agree that validating the records first is a safer approach, especially when dealing with restore, update, or delete operations.

[sivakumaraa]

Hi @Ankith Sharma, Records is available in sys_audit_delete table bro but need to retrieve the deleted records by using created on condition 

[Ankith Sharma]

Hi @sivakumaraa 

If the records are already present in sys_audit_delete, then the query may not be the issue.

One thing I'd verify is whether you're filtering on the correct date field. When you say "created on condition", do you mean:

• The Incident's original sys_created_on value before it was deleted?

• Or the date when the delete audit record was created in sys_audit_delete?

These are different values.

If you're trying to restore only Incident records that were originally created on a specific date, you may need to inspect the audit delete record contents and identify which field stores the original Incident creation date before applying the undelete logic.

Could you share:

• The exact condition you're trying to use for "Created On"

• A screenshot of one matching record from sys_audit_delete (sensitive data masked)

That would help determine the correct field to query before restoring the records.

If you found this useful, feel free to mark it as Accept as Solution and Helpful. It makes my day (and helps others too 😉).

Regards,
- Ankit
LinkedIn: https://www.linkedin.com/in/sharmaankith/

[Mark Manders]

Why? What is your requirement here? Why use a script to do this, instead of using the OOB way to do this? Someone messed up. That is 1. If you are looking to restore deleted records through script, it's not just one or two records.

You want to restore them. Then why trying to do it in a way that doesn't work? Go to the deleted records, select the incident table and the date of deletion (creation of deleted records), select those and use 'undelete'. It's there for a reason. No need to script. Use what you have (and is proven to work).

BUT.... WHY? If they are deleted on May 20th, you are restoring incident records that are 15 days old. You are restoring issues that (hopefully) have been resolved already. These will start triggering all logic again and will cause a lot of confusion to your users.