sysevent table contains only 4 days worth of data. Why?

[Daisy8]

I am writing an application to query sysevent table via the REST API.  I need to get last 30 days of events.  However, my query returns only 4 days worth of data even though my query specifically asks for 1 year of data.

HTTP URL (GET method):

https://my-instance-name.service-now.com/api/now/v1/table/sysevent

Query parameters:

sysparm_limit=1000

sysparm_offset=0

sysparm_query=sys_created_on>2018-01-01 00:00:00^sys_created_on<=2019-12-31 00:00:00ORDERBYsys_created_on

My question is:

Why does sysevent return only max of 4 days worth of data?

Is there a configuration that I can tweak to have it return more than 4 days?

Any information in this topic would be much appreciated.

Thanks in advance.

[Giles Lewis]

This is probably the sysevent record in the sys_auto_flush table. Ours is set to 604,800 (7 days). 

I would be careful about setting your retention too high. I would advise you instead to use a Script Action to copy the data you need to a custom table at the time the events are generated, rather than querying sysevent directly.

There is probably no way to recover records that have already been purged. (Maybe you could ask ServiceNow if they have a backup which can be restored to a non-production instance.)

[Tony Chatfield1]

Hi, I think that table rotation is enabled for sysevent OOB so there may be potentially additional data available.

But I don’t know if table rotation has always been enabled, so if you have an older instance it may not be configured. If it’s not enabled for your sysevent table then you should look at enabling it if you intend to retain larger volumes of data.

A sysevent table can produce millions of records a day in a busy environment,
so a result of 1000 records may be little more than a blink of the eye; and I would be red flagging any requirement to extract data from sysevent as it may cause degraded performance - It’s a busy table that’s core to platform functionality.