How to identify what updates a field ?

[Gopi22]

Hi Team,

We are facing an issue in our ServiceNow instance. 

We see that the "Most Recent Discovery" field in cmdb_ci table gets updated by SCCM integration daily, which is the expected behavior. 

Later, we also see that the same field is updated incorrectly by something else, but not sure what updates it. 

How can we identify, what updates the field ? Any pointers on how to troubleshoot, would be really helpful. 

Thanks,

Gopi

[Mark Manders]

Check on your system logs. If you add the 'context map' field to the form, it will show you where it's coming from (like a script or flow). Other than that, it will be just checking. You already know the user that updated it, so you could check on that user: is it running any scheduled jobs or flows?

[Gopi22]

Hi Mark,

Thank you for the update. 

I am not sure how to get the information for the particular field update by adding context_map tp the list layout in syslog list layout. Could you please elaborate on that. 

Also, from the audit history in the cmdb_ci table (of that particular field in the record), I could see that the update is made by System Administrator. But how the update is made is what is unknown, is that a scheduled job or any other server-side script which is making the update. 

How can we troubleshoot this ?

Thanks,

Gopi

[Mark Manders]

The context_map shows you what script was the cause of the system log entry. So if the update is done by a script or flow or something like that, you can look in the logs to find the update and see what was the cause.