question Work Note extraction from Incidents in Community Central forum

Work Note extraction from Incidents

luisenvenga — Thu, 10 Sep 2026 16:09:39 GMT

Dear community

How to get the complete conversation/work notes from the Incidents?

The task is simple. The steps are nowhere to be found.

The only piece of info I could get was a video claiming we can use APIs or Coding to get the incidents data, but nothing else and no additional detail was given

Appreciate your support.

Re: Work Note extraction from Incidents

Rafael Batistot — Thu, 10 Sep 2026 22:07:26 GMT

Hi @luisenvenga

Work notes and comments are not stored directly on the ⁠incident⁠ table, they are stored in the Journal table (⁠sys_journal_field⁠).

This might help you

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0791043

Re: Work Note extraction from Incidents

luisenvenga — Thu, 10 Sep 2026 22:13:17 GMT

Hello Rafael

Greatly appreciated! Seems like I don't have enough authorization. I'll return to you once I get the access to sys_journal_field

Thanks

Re: Work Note extraction from Incidents

Ankur Bawiskar — Fri, 11 Sep 2026 02:43:07 GMT

@luisenvenga

what's your exact business requirement?

if you want to do reporting on sys_journal_field then it's not allowed OOTB as it's system table

But once you update this property with that table it will allow you to create report on that table

glide.ui.permitted_tables

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

Re: Work Note extraction from Incidents

luisenvenga — Fri, 11 Sep 2026 15:38:50 GMT

Hello Ankur,

Details shared: The request is to extract full Work Notes history, including all comunications between agents and customer. We will feed this into an analytical AI tool to transform the text into comprehensible analytical data.

Data that will be used to work on the real root causes. We've noticed a lot of mismatches between what the agents declare as Root Cause vs Work notes conversation. For example:

User clearly requests ownership change in the app. The roles are missing for a new hire.
IT team categorizes this as Knowledge Gap. In reality, it's a security request/technical limitation . Not a Knowledge Gap at all.

The Work Notes history analisys will help us understand what really happened on the tickets, in mass.

Going back to your point: I assume that after I get system admin role access, I should update a property from the sys_journal_field table. Could you please elaborate more on:

the property and the value needed and
where and how to take care of this?

Thank you!

Re: Work Note extraction from Incidents

VJ_Srivastava — Tue, 15 Sep 2026 13:09:58 GMT

Hello @luisenvenga,

From an architectural standpoint, extracting journal fields requires careful planning, especially if you intend to do this at scale for thousands of incidents.

The sys_journal_field table is typically one of the absolute largest tables in any enterprise ServiceNow instance, frequently housing hundreds of millions of rows.

If your goal is to extract the complete conversation history for a single incident via a one-off API call, Neha’s REST API approach is perfectly fine. However, if you are attempting a bulk extraction—such as dumping all incident work notes into an external data lake, PowerBI, or an external LLM for analysis—you must exercise extreme caution.

Running heavy, unbound queries against sys_journal_field during business hours can severely degrade your database performance and cause platform-wide latency. For bulk extractions, I strongly advise against raw REST API loops. Instead, utilize native architectural mechanisms like the ServiceNow Instance Data Replication (IDR) or scheduled batched exports during off-peak hours to ensure your production instance remains highly performant.

Re: Work Note extraction from Incidents

NehaG8791370651 — Tue, 15 Sep 2026 13:11:45 GMT

Hi ,

This is a very common requirement, and the reason you can't find it directly on the Incident form is because of how ServiceNow stores data. Because work notes and additional comments can be infinitely long, they are not stored in the incident table. Instead, they are stored in a separate, massive background table called sys_journal_field.

Here are the two best technical methods to extract them:

Method 1: Server-Side Scripting (The easiest way) If you are writing a Business Rule, Script Include, or Background Script, you do not need to query the journal table manually. ServiceNow has a built-in method called getJournalEntry(-1) which fetches the entire history as a single string.

The Code: var allNotes = current.work_notes.getJournalEntry(-1);
Note: Passing -1 tells the system to get all historical entries, not just the most recent one.

Method 2: REST API Integration (For external systems) If you are using Postman, Python, or a third-party tool to extract the data, you must query the journal table directly.

Endpoint: GET /api/now/table/sys_journal_field
Query Parameters: sysparm_query=name=incident^element=work_notes^element_id=YOUR_INCIDENT_SYS_ID
This will return a JSON array containing every individual work note for that specific incident.

Re: Work Note extraction from Incidents

luisenvenga — Tue, 15 Sep 2026 18:30:25 GMT

Thank you Neha

I will try method 1 with my dev team. i really appreciate your help. I will update you back once one.

Regards

Re: Work Note extraction from Incidents

luisenvenga — Tue, 15 Sep 2026 18:42:07 GMT

Hello Srivastava

I don't think IDR or APIs are needed for this case. The data does not require continuos integration back and forth (for now). This is a single time event, for analaysis.

We will keep a keen eye on this in case if it's needed later.

Thanks again and regards

Re: Work Note extraction from Incidents

luisenvenga — Thu, 17 Sep 2026 15:57:40 GMT

Hello Neha,

Just spoke with system admins and Project stakeholders and they don't see any additional value on creating code or connecting an API for a single time event.

Can you think about any other solution? Any way I can upate the properties of the sys_journal_field table into a regular table from which I can run standard reports?

Thanks and regards.