System is creating new records automatically with empty "Created" and "Created by" fields

[Farah5]

I'm dealing with a very strange issue I've never seen before. We have a custom table where you can save a form as a "Draft" (current status = draft). Several fields are required to be filled out before you can even save it as a draft. However, we've noticed that there are a bunch of empty Draft records being automatically created in the system. The record is active, but not a single field on the form is filled out. The strangest thing is that the "Created" and "Created by" fields are empty, and there is no history whatsoever on the record. This makes it extremely difficult to pinpoint when and how these tickets are created. 

Does anyone have any idea of what could cause a record to be automatically created without a "Created" or "Created by" date? This is happening in our DEV, TEST, and PROD instances. There doesn't seem to be any pattern for when these are created. 

[brandenwright]

What does List show for the blank records?  I agree with Ankur that the most likely culprit will be an automated function of some sort.  Do these have workflows?  Check the numbers of the records.  You should be able to narrow down the time by looking at when 2 known records were created if the number falls between them.  See if the field Opened or Opened by has data in it?  Is this custom table extended from the Task table or is it a new creation by you?

[Farah5]

The behavior is strange when I click List for the blank records - it simply re-directs me back to the list view of the table. This isn't happening for normal records. 

And yes, they have workflow, I just checked the start time of each workflow and they're all pretty random. Some start times are:

- 08/18/2020, 11:05:03

- 09/01/2020, 16:01:02

- 09/09/2020, 11:36:08

- 9/14/2020, 07:27:00

- 09/28/2020, 08:52:52

The values for the Opened field for these records is identical to the workflow start times. Opened By is empty. 

This table does extend from Task. 

[brandenwright]

This is a step forward at least.  Now you know when they were created.  The last date is awhile ago, so searching the log might be problematic.  Search it for that exact time.  Look for the table or an event that occurred.

I would also check your workflow logs.  Go to Workflows > All Contexts.  If these are triggered by a workflow you should see a context here that created it.  See what type of behavior it had.  I had a faulty script on a request workflow which prevented the SCTASK from getting created.  Something similar might be happening to you.

[Farah5]

Hm, there is a workflow context for these records, but I'm not too sure what else I should be looking for. What do you mean by type of behavior?

[brandenwright]

Apologize for the late reply.  The one thing I always try and remember is that ServiceNow only does what it is told to.  It doesn't have a mind of its' own.  What I mean by that is that there is a setting or trigger somewhere that is causing this to occur.  Our goal is to find that trigger.  We find it by looking at what is the common link between all of these separate records.  What do all of these records have in common?

Look at the workflows.  Is there any scripting going on?  Does the script say update or insert?  Look at the completed contexts.  Compare a context between a record that didn't create a blank entry to the one's that did.  Do the blank records all follow the same path?  Are they all from the same person/department/location etc?

Something ties all of them together.