what's the difference between update time and created fields in sys_history_line table?

Anushree Randad
ServiceNow Employee
ServiceNow Employee

What is the difference between updated time and created fields in sys_history_line table? I am trying to pull a report which will show me field value from sn_compliance_control table which were changed after 12/6/2016. Not sure which field to use from above 2? I assume when there is any change in the field value, a record gets created in history table so is created field more relevant or updated time (Not even sure why do we have updated time apart from updated and i don't see any value in updated field)? Updated field is blank so can't use that. Can someone help me with this as soon as possible?

7 REPLIES 7

Understood, Anushree. You can back out the Number, for example, using the documentkey [Document Key] field in sys_audit, but it's not a reference field (for good reasons) so you can't dot-walk - one way I can think of is to do a join on sys_audit.documentkey = sn_compliance_control.sys_id using a database view or simply use the sys_id from sn_compliance_control to filter sys_audit.



My understanding is sys_history_line is populated on demand using sys_audit and other tables, so it does add the convenience and more information in one place, including the set field, as you mentioned. Also, because the creation of records is not captured in sys_audit by default (although it can be turned on), sys_history_line reconstructs the create event by inspecting the record and the record's sys_created_on. So, going back to your question, here are the differences between these two fields in sys_history_line:



  • sys_created_on [Created]: when the entry in the sys_history_line table was created
  • update_time [Update time]: when the audited field value was updated (this is always <= sys_created_on)


For example, these fields would have different values when sys_history_line entries are first created, on demand, for the audited record. So for your purpose, I believe the update_time [Update time] field is the one to use, as you and Jeremy pointed out.


Thanks a lot for the elaborate explanation John. This helps!


You're welcome. Would mark replies from Jeremy and me as Answer / Helpful as appropriate? Thanks.