Date/Time when an Incident state was last changed (not when the incident was last updated)?

[esguaravkumar]

For our use case, we would like to know the time when the status of an incident was last changed to its current status.   For example, incident was moved from a previous state Assigned to On Hold - Pending User.    We would like to know the time stamp of when this change happened via the Service Now REST or other APIs.    We are not looking for a webhook call back -  we can only query for this information.   We are also not able to create business rules or custom fields on our downstream customer's instance so hoping to find a standardized out of box approach to get this information in Tokyo or later releases.

(sys_updated_on is affected by any change to the incident including when someone puts in a comment so does not suffice for our purposes)

By way of background, once we have this information we have an alert tool that will be used to notify various stakeholders.

[Weird]

The only place where you could get that information is the sys_audit table.
Of course you'd still need a read access to the table (admin OOB) and you'd have to know the sys_id of the record you're looking for.

If you're allowed to create a scripted rest api, you could build one which would query the audit table and return the update date as a response. This wouldn't require new BR's or fields and would only add a layer to the integration.

Other than that I don't see where'd you get the information directly since it's not stored directly on the target table.

[asifnoor]

Hi,

If you do not want to write business rules or capture this information on update of priority, then it is little tricky. you can use sys_audit table, but it will be performance intensive. The sys_audit table stores everyupdate of the field (if audit is enabled on your table). Since you are referring to incident table, just go to sys_dictionary and there check for incident tabe and see if audit checkbox is true or not. (ref: https://docs.servicenow.com/bundle/tokyo-platform-security/page/administer/security/task/t_EnableAud...)

Once that is enabled, then you can go to sys_audit table and from there you can know when the value is changed. Look at this screenshot below to get an understanding of it.

In this you can see oldValue and newValue. Based on these fields and created by, you will know when the change has happened. Hope this helps.

Mark the comment as a correct answer and helpful if this has answered the question.

 

[asifnoor]

Kindly accept the comment as a correct answer if this has answered your question.