Getting activity log of specific incident through the REST API

[mahadevanswamy]

I would like to know how to get the activity log of a specific incident through the REST API. I have looked at a similar post in this forums and it didn't help me out. I am using Service NOW Helsinki. Please let me know the table name by which I can get the activity logs of a specific incident.

Thanks in advance,

Swamy

[mahadevanswamy]

Yes I would like to know when a field in a record was last updated on and I am looking to get this information from the API.

[varads_kulkarni]

As I see, you already have the sys_id of the incident. Once you have the sys_id of the incident, you need to query the sys_audit table with the query documentkey=sys_id (obtained above).   You may ask for fieldname,oldvalue and newvalue in the response.

As an example, you may query like

https://dev11111.service-now.com/api/now/table/sys_audit?sysparm_query=documentkey=sys_id&sysparm_fields=fieldname%2Coldvalue%2Cnewvalue

And you will have a response like

{
  "result": [
  {
  "fieldname": "incident_state",
  "newvalue": "2",
  "oldvalue": "1"
  },
  {
  "fieldname": "activity_due",
  "newvalue": "2017-08-01 10:00:48",
  "oldvalue": "2017-08-01 09:39:57"
  },

  {
  "fieldname": "state",
  "newvalue": "2",
  "oldvalue": "1"
  }
]

}

[Daniel Gurney1]

But how do entries in sys_history_line correlate with records in incident table?

I see no match in sys_history_line table results with sys_id of incident table.

Fetch all sys_history_line entries:
https://xxx.service-now.com/api/now/table/sys_history_line

Scan results for sys_id of incident: 10e32f11db320010380bbd51399619a8
no match. 

I like the idea of using sys_history_line to get activity and comments as it does not need elevated privilege, whereas sys_journal_field does.

With sys_journal, i can get the comments for the specified sys_id:

"https://xxx.service-now.com/api/now/table/sys_journal_field?sysparm_query="
+ URLEncoder.encode("element_id=10e32f11db320010380bbd51399619a8^element=comments", "UTF-8")

 UPDATE:

One of the replies said to query for "set=<sys_id_of_incident>"

"https://xxx.service-now.com/api/now/table/sys_history_line?sysparm_query="
+ URLEncoder.encode("set=10e32f11db320010380bbd51399619a8", "UTF-8")

no results

Another reply said to use "set.document_id=<sys_id_of_incident>".  Again no match.

[Bhawanjit Sing2]

Hi @mahadevanswamy @Chuck Tomasi 

You can try a GET method using below API

https://<Instance_Name>.service-now.com/api/now/table/sys_history_line?sysparm_query=set.id=<sys_id of record>

Please mark it helpful if it works.

[henrique_ianni]

Hi @Bhawanjit Sing 2, thanks for your help.
How can I add a filter by date in addition to the sys id?