which audit table stores asset data in servicenow

reyservicenow · ‎04-28-2017

Would it be the sys_history_line table? This table seems like it can be used for anything.

Jon Barnes · ‎04-29-2017

if you do report on the audit table, you will want to ensure you control what is being queried. I wouldn't open that up to the business users because they could query anything and bring down your instance completely. So, if you knew the business users wanted to track changes to a specific field in a specific table, you could create a report that only an admin can modify that would query for changes in that specific table/field combination.

If you decide to do that, I would be sure to add an index to the sys_audit table on the tablename, fieldname, and maybe sys_created_on columns in a composite index. Then, you can create your report to show any changes to that field and table in the last 30 days or whatever. I don't know if SNOW will be thrilled with that index because I imagine it will take up alot of space. Also, be aware that indexes will generally speed up your queries, but can slow down your inserts, and since there are alot of inserts on the sys_audit table, this could be a problem over time, but I don't know how much.

Also, if the client knows which table and field they want to report changes on, you may consider setting up a metric definition to track it, and then you can report on the metric instance table.

So, long story short, you do have options for reporting, but just have to be careful because the tables are so large.

have a look at this wiki article about reporting on system tables, if you decide to take that approach.

Reporting on System Tables - ServiceNow Wiki

View solution in original post

Jon Barnes · ‎04-28-2017

Sys_history_line is more transient, and is actually built from sys_audit, so I would look to the source in sys_audit.

let me know if that is what you are looking for.

reyservicenow · ‎04-28-2017

Need to figure out which stores the audit info for the asset table

reyservicenow · ‎04-28-2017

Does the audit tell you what the previous change is?

And how can i put that in a report? The one table that gave me a previous change field was the sys_history_line how can i put any of those two tables in asset report?

Jon Barnes · ‎04-29-2017

All auditable record changes are stored in sys_audit as the source. sys_history_line is built for the history view and activity feeds. But sys_audit is the right place. However, you can't and arguably shouldn't report on either of those tables because they will be huge. sys_audit is indexed on the document key, which is the sys_id of the record to which it relates, so if you want to lookup audit history for a single record or group of records by sys_id, it is still fast.