how to check if last update on a field is a certain user.

[samadam]

I need to find if the last update on a field is a certain user? This is on the cmdb_ci_computer table. I am looking at the audit table but I dont see a good way to figure out what is the last update for each ci record. any ideas?

[Mike Allen]

Check the sys_history_line table.   That should show you.

[alinatoc]

Last time I worked on creating a script include serving as simplification to get rid of repetitive queries when accessing Audit information about a record, I had a trouble using sys_history_line table. I discovered that there times when you update a record, the audit information won't appear in that table until you request the History list of a record which makes it an "on-demand" history tracking table. So I opted back to sys_audit table. Yes it's a huge table, but IME, it's the ultimate table containing real-time record updates. When querying against this table, adding timestamp would make your query optimal.

Here's a reference: Differences Between Audit and History Sets

[Mike Allen]

Each sys_history_line is controlled by a sys_history_set entry.   Yes, there is unpredictability, but I worked at a company that had greater than 100M records in sys_audit, which on occasion took over an hour to query, based on what the query was.   Regardless, I did not read the original request as 'I want to write this script to return the last update', I read it as 'Where can I find this info'.   Querying sys_audit is a bad idea unless you are super good at writing super streamlined code.

[alinatoc]

What is your definition here when you say "certain user"?

To answer your question, the User field in sys_audit table contains the User ID of the last user who did the modification. You query that in sys_user table to find the ServiceNow user account that did the update/change.