how to change text in the activity log for a worknote entry

[HugoFirst]

We have a change task with inappropriate text in the activity log due to an entry in the worknotes field.
How can I change the text to overwrite the inappropriate text?

[michaelslabodni]

You're certainly not the first person to come across this....

The activities (comments/work notes) are stored in the sys_journal_field table. But be very careful - that table is huge and if you see everything, it'll take a long time to load. If you can, put in a value for sysparm_query to limit the data. Something like {instance_name}/nav_to.do?uri=/sys_journal_field_list.do%3Fsysparm_query%3Delement_idSTARTSWITHbb8c1219dbed9f0021b4fa56bf961937%26sysparm_first_row%3D1%26sysparm_view%3D%26sysparm_choice_query_raw%3D%26sysparm_list_header_search%3Dtrue

The element_id field points to the sys_id of the record that's associated with the comment/work note.

 Last thing to keep in mind - if auditing is enabled for that field you likely have the same data in the sys_audit table. You'll have to do the same thing - find the specific record in the audit table and delete that record.

 Last last thing - while the records will be deleted, if it happened before the latest backup occurred, then just know that the data still resides in one of the instance backups. The backup data is recycled every 28 days though and after that time the data is completely gone for good. I think there is a whitepaper out there written by a hospital that detailed their solution for deleting patient information in the event HIPPA information was accidentally saved into ServiceNow. If the backup hasn't been run yet, then once you delete the data, it's gone.

[HugoFirst]

Thanks for the great advice Mike!  It got me going where I needed to go.  I'm summarizing my action below and following up with one question.

To sum up the actions I took:

1.  I located records with the offending text in the sys_journal table and edited the entries to remove it.

2. I then located entries in the sys_audit table and edited them to remove the text.

3. I finally located the entries in the sys_history_line table, which I deleted, since I was unable to edit the entries.

4. I also search the sys_email log for entries which contained the offending text.  I was able to edit 2 fields in each entry, body and body_text.  I removed the offending text there.

The result is that the worknotes no longer appear in the activity log.  But the email entries with the edited text do.

My question is this:  Can I regenerate the entries in the sys_history_line table for this record? I'm hoping to restore the worknotes to the activity log and the task's history.