How to track where a RITM came from

[DevtoSME]

Hi all,

I’m trying to trace how a specific Requested Item (RITM) was created in our instance, and I’ve hit a wall. Here’s what I know so far:

The RITM has no associated Flow Context, Workflow, or approval flow

The Contact Type is “Email

The Opened By user is a placeholder/integration user (sender@workflow.oraclecloud.com)

The short description matches an automated report sent from Oracle Cloud via email

The Email Received record shows a target table, which is a custom table — not sc_req_item

the custom table record has no references or fields pointing back to the RITM

• I’ve checked all Business Rules, Flows, Script Includes, and Scheduled Jobs on the custom table — nothing found that creates or touches sc_req_item or sc_task
• There’s also no reference to the RITM’s short description anywhere in any scripts or config

However this RITM is requested by looks like a diff account it has the word "oracle" in it. a There are 5 catalog tasks on the RITM, but no trace of how any of it was created. There no flow context or catalog item related to it. The short description says its a daily report so i assumed its a inbound email or scheduled script but none of the ones i searched for creates a request. 

Does anyone have guidance for tracking non-standard or indirect creation of a Requested Item — especially when it may be triggered from a custom table record created by an inbound email? Also i have search the email logs and there are subjects that say "daily reports for this table" but where can i find out how to configure the RITM or if this is being generated from a RITM. 

Appreciate any direction. I’ve exhausted the usual audit, Flow, and rule-tracing methods.

[YaswanthKurre]

Hi @DevtoSME ,

Seems like you looked into everything.

Try looking into Scripted Rest API's  and Transaction Logs (syslog_transaction) — filter by the RITM’s sys_created_on timestamp and look for any scripts or users that might have created it.

Mark this as helpful and correct if this solves your issue.

Thanks,

Yaswanth

[Arun_Manoj]

Hi @DevtoSME ,

may be through cart API, please check below link

https://www.servicenow.com/community/developer-forum/cart-api/m-p/2023814

Thanks

Arun

[Ankur Bawiskar]

@DevtoSME 

you will have to identify the pattern for the RITM created.

Similar RITM is created daily or weekly?

who is the created by user of that RITM?

If my response helped please mark it correct and close the thread so that it benefits future readers.

[DevtoSME · Accepted solution]

I ended up finding that there were actually two inbound emails — one creating the report record and another creating the requested item. None with related names so i just filtered the sc_teq_item table and went through each on. The script created the RITM and started a workflow, which then created the related task. Appreciate the help.