SysEvent table is returning only 4 days of events data

[Vivek81]

Querying Sysevent table is fetching only 4 days of events data. 

As per this doc: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0749943, it should have at least 7 days of data, but we are unable to see.

Could someone please help us if we need to update any setting to get the last 7 days of events.

Thanks.

[Community Alums]

Hi Vivek,

A sysevent table can produce millions of records a day in a busy environment,
so a result of 1000 records may be little more than a blink of the eye; and I would be red flagging any requirement to extract data from sysevent as it may cause degraded performance - It’s a busy table that’s core to platform functionality.

I think that table rotation is enabled for sysevent OOB so there may be potentially additional data available. Unless it is updated by someone it should be available for 7 days

But I don’t know if table rotation has always been enabled, so if you have an older instance it may not be configured. If it’s not enabled for your sysevent table then you should look at enabling it if you intend to retain larger volumes of data.

Learn more on Table rotation here :https://docs.servicenow.com/en-US/bundle/sandiego-platform-administration/page/administer/platform-p...

Mark my answer correct & Helpful, if Applicable.

Thanks,

Sandeep

[Hitoshi Ozawa]

Hi Vivek,

In the Table Rotation (System Definition > table Rotation) list, filter by Name = sysevent.

Open the record and look at the Table Rotation Schedule. In my PDI, there are 8 records. Sort by "Valid to" to see when the event table will be deleted.

In my instance, the oldest "Valid from" is "1970-01-01". The next oldest is "03-31" as of "05-06". The record with "Valid from" = "03-31" also have "Offline" = "true" to denote this is actually the oldest table in the rotation and due for deletion next. Check the "Table name" of this record. Mine is "Event[sysevent0002]".

To view content of this record, enter "sysevent0002.list" in Navigator. I can see events with "Process on" dated "03-31".