Process Mining Cloned instances and Audit Log data

[E Chow]

Hello: I am utilizing the ITSM Content Pack to process mine our organisation's incident table. It is regularly cloned to match production.

We have an issue with the audit log that impacts the accuracy and efficiency of the PM output: The system Clone excludes ...tables for logging, auditing, notifications, workflow contexts and license usage.

So every node has a 0s duration and no improvement opportunities after mining. 

Has anyone come across this and found a workaround (It's a time waster to create 3,600+ incident records in the test instance)?

[chirag_bagdai · Accepted solution]

@E Chow - Process Mining gives insights from audit logs so, you need to ensure that you have required audit logs for the records that you want to mine. 

While cloning an instance, uncheck clone option for audit logs so that audit logs will also get cloned. 

KB: 

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1214608

Use prod. instance instead when you don't have audit logs in sub-prod. instance

[chirag_bagdai · Accepted solution]

@E Chow - Process Mining gives insights from audit logs so, you need to ensure that you have required audit logs for the records that you want to mine. 

While cloning an instance, uncheck clone option for audit logs so that audit logs will also get cloned. 

KB: 

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1214608

Use prod. instance instead when you don't have audit logs in sub-prod. instance

[E Chow]

Chirag: Thank you for the post. If my administrator declines this option, is there a way to down then upload audit log data for specific tables manually?

[chirag_bagdai · Accepted solution]

Yes, you can download audit logs from "sys_audit" table and import them in sub-prod. 

However, sys_audit is one of the heavy table in ServiceNow so, you have to be careful while accessing or while applying filter query.

You can use below Query to access all audit logs related to incident table.

https://INSTANCE_NAME.service-now.com/sys_audit_list.do?sysparm_query=tablename%3Dincident

 

If you want to download only few incident data then you can get sys_ids of those incidents and use below URL:

https://INSTANCE_URL.service-now.com/sys_audit_list.do?sysparm_query=tablename%3Dincident%5Edocument...

Replace SYS_IDs_WITH COMMA SEPARATED with actual sys_ids of incidents with comma separated values (f1626a40dbf3a700f720f9c31d96194b, e88269ecdba1f60066d8f4bbaf9619c6)