Querying change history of incidents

[naushad]

I want to query from an external application of all the changes that happened on an incident after a timestamp.

Example:

Incident: INC00001

status: new   (update 9:05AM)

status: work in progress (update 11:35AM)

status: closed

close_notes: resolved by adding a patch (1:00PM)

I want to query all the changes that happened after 9:00PM and should get 3 items with the payload containing the changes.

Which table should I query for the history (or audit)?

[Pradeep Sharma]

Hi,

sys_history_line is the table which holds the value. However I would   not recommend to query the table as this is the largest table in the instance.

However you can go with metrics and query the incident metrics table.

http://wiki.servicenow.com/index.php?title=Metric_Definition_Support

[Paul Ciarfella]

The problem is that metrics do not show the old and new values.     This is a fairly common reporting request - show all changes to state or changes to assignments (who from and whom to).

[bjhughey164]

Paul,

Were you ever able to get this figured out? I'm currently in the same boat attempting to find a history of assignment changes.

Thanks

[johnram]

The ServiceNow Wiki content is no longer supported. Updated information about this topic is located here: Metrics

Visit http://docs.servicenow.com for the latest product documentation