question Re: Incident Label History in Community Central forum

Incident Label History

tlohnes — Wed, 16 Jul 2025 19:50:26 GMT

I am inquiring about how one would audit/report on the tag assignment (including changes) to an incident?

I have found the labels in the label_entry table, but I am looking for the history of changes as well. Is that possible?

Re: Incident Label History

GlideFather — Wed, 16 Jul 2025 21:09:30 GMT

Hi @tlohnes,

for the audit on anything in ServiceNow, when it is not active and you will activate it, it doesn't show the history retrospectively. So below I will show you how you can start auditing your wanted fields and their changes but you will be able to see it after you do it, not before...

For that, go to System Definition > Dictionary and search for the table of your need - in this case [incident], then filter the records that Type == Collection, and add a column Audit and mark it true.

if you mark it true as per the first row, it will apply to all the form with every field in it, but if you want to do it for selected field only that would be the lines below:

(alternative is to go to field's sys dictionary and add the attribute for audit true, it is the same, but this seems easier to explain)

Once you marked the Audit true, after that you will be able to see changes in Audit [sys_audit] table:

Here you have Document key (that is the sys ID of a particular incident), Old and New value (changed from what to what), by whom, when and in what field of incident.

This will be applicable to anything that you need or if you want to stop auditing you just do negation of the step 1 but remember the audit start to creates records after it is true, not possible to get these information retrospectively.

You mentioned tags, that would need to start the audit and then you can see that as well. Please let me know if this is what you were looking for and if my response was helpful

Re: Incident Label History

GlideFather — Wed, 16 Jul 2025 21:13:21 GMT

@tlohnes

for the label_entry, it is the same, navigate here:

https://yourinstance.service-now.com/sys_dictionary_list.do?sysparm_query=name%3Dlabel_entry%5Einternal_type%3Dcollection&sysparm_view=

And mark the Audit to true. From that moment on you should be able to see the Audit history under this link:

https://yourinstance.service-now.com/sys_audit_list.do?sysparm_query=tablenameSTARTSWITHlabel_entry&sysparm_view=

Please tell me how much do you love this new feature in your instance

Re: Incident Label History

GlideFather — Wed, 16 Jul 2025 21:42:37 GMT

@tlohnes I have been testing it for label_entry and adding and neither removing tags is not audited anywhere, despite evey relevant fields were set Audit == true...

only what is audited is for example if you rename "Test tag" to "Test Tag 1", that will be audited but not adding and removing...

You would be able to see adding tags in a report but not sure how to do it with the removing, perhaps a business rule on the label_entry table triggering an event but is that really necessary?

Re: Incident Label History

GlideFather — Thu, 17 Jul 2025 06:16:02 GMT

@tlohnes

you can check script include TagUtil:

And eventually add there an event (one for adding and one for removing) with parameters - user and where the tag was,

Re: Incident Label History

tlohnes — Thu, 17 Jul 2025 16:00:20 GMT

Thanks @GlideFather so much for taking the time to share this information—it's really appreciated.

The key takeaway for me is that adding or removing tags isn't tracked or audited in ServiceNow, which is a significant limitation. Unfortunately, the auditing options you mentioned aren't available to me due to my current access or permission level.

Still, it's very helpful to understand how it works. Thanks again!

Re: Incident Label History

GlideFather — Thu, 17 Jul 2025 16:05:31 GMT

Perfect, thank you for confirming my efforts were not for nothing!

have a wonderful day and get back if you have any detective work for me 😄