How to find out who has deleted dictionary entry

[Ilkka Kangas]

Hi,

I recently discovered that one field of a table is missing (has been deleted). I discovered that the first time an error occurred because of a missing field is on 8.4.2023. I cannot find any update (sys_update_xml) that deletes the field. Is there any other way to find out the deletion timestamp and the user?

Thanks

Ilkka Kangas

[Daniele B]

Hi IIkka,

there is a table called : sys_audit

If the field is tracked , you can find information about the deleting on this table.

Please note that not all fields are tracked! (of course you can activate it but the performance will be impacted)

If my answer is useful, please make helpful or correct.

Regards

[Ilkka Kangas]

Thanks for your response. I cannot find any traces of the deletion from the sys_audit table.  

[Mehta]

if someone manually deletes a field and there is no attached data associated with that field, there are three options to consider to restore these fields:

The Deleted Records module can be used to restore a deleted record. See Use the Deleted Records module to restore a deleted record
Recreate the field that was deleted
There is a sys_metadata_delete (Deleted Applications File) table that may contain the missing data for the deleted field. You can simply find the records that were deleted and restore the files for that record.

Below is the KB Article from Servicenow: 

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0727965

[Ilkka Kangas]

Hi, thanks for your response. 

I tried to find traces of deletion using your advice but no luck. I think I need to contact technical support to figure out what has happened. Like the KB article says in the end 

Note: If someone manually deletes a field and there is attached data associated with that field, contact Technical Support.