Where to find Audit History? Please help I'm so stuck

[Lockstep]

Hi all, been bashing my head against this one for days now and need some expert advice. 

I have a field within my [incident] table - 'Environment'.

When I click into the Record History as you can see in the screenshot below, I can see the audit history of that record, including who updated that field, what time, and to what value. 

I want to create a report based on the audit history for this field such that the table displays all Incidents that have been created within the past 7 days, grouped by the user who has updated that Environment field. 
This will tell us who is triaging more tickets than others. 

However, when I try to create a report off of the Incident table, where the Environment field information is stored, there is no field for audit history. Updated By is an available field, but only refers to the user who last updated ANY field, not the specific environment field. 

I'm really stuck here. 

Do I need to create a new table that extends incidents and captures both the environment field and who updated it? 
Is the audit history that is displayed in my screenshot visible on another table that I'm not aware of?
Is there a way of adding the environment field to another table?
Do I need to somehow create a report from two different tables?

Please help me on this 

[James Chun]

Hi @Lockstep,

First of all, you should never create a report against the Audit [sys_audit] table as it can cause performance issues.

Second, the records you see by viewing the 'Record History' are actually from the [sys_history_set] and [sys_history_line] tables. See the reference for the details - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0547662

Now to solve your issue, I would recommend creating a Metric definition on the 'environment' field.

This will create Metric Instances for each time the field is updated and provide you with the information such as who updated it, when it was updated, etc. See the doc for the details - https://docs.servicenow.com/bundle/washingtondc-platform-administration/page/use/reporting/concept/c...

One important thing to note with Metric is that you can only capture the data after the definition is created.

Curios to know though, how does this answer your question - who is triaging more tickets than others

Cheers