Where is incident state change history or update date/time stored?

[Suzanne Coffman]

If I want to include the date/time that an INC was changed to a state of On Hold in a report, in what table would I find that field?  Or better yet, is there an OOTB metric for length of time on hold by assigned to person?  I looked at wf_activity but it seems to have nothing related to incidents at all.  I can't just use the last update date/time for incidents with current state = on hold because if someone adds a worknote that will update it, right?

[Yousaf · Accepted solution]

Hi Suzanne,

Please refer to this link

incident form change history

Mark Correct or Helpful if it helps

[Sandeep Rajput]

All the changes related to a record are usually kept inside sys_history_set and sys_history_line tables. You need to query sys_history_set table with your incident sys_id to get the sys_id of sys_history_set record. Use this sys_id and state field as a filter on sys_history_line table to get the records related to states and from there you can calculate for how long the incident was in the state of on hold.

Attaching few screenshots to provide more clarity.

[Nenad Berbatovi]

Hi,

Is there any identic or similar functionality in Service Operation Workspace, INC record?

Best regards,

Nenad

[mjeeth]

New to servicenow , Will i be able to see the emails sent for the record also in this list?

(i am unable to see the emails sent for the record either in work notes nor in change history)

can you pls help?