Is there a way to audit a user's activity in ServiceNow by date?

[Tonya Valdez]

I need to see what a user did to delete records in ServiceNow ... is there a way that I can do an audit based on his name or user ID?

[Brian Bouchard]

Hi Tonya -

If you're only concerned with deleted records, you can use System Definition => Deleted Records to see everything that was deleted over a specific time period and filter by "Updated By"

For a variety of other activities you can query the System Logs -> Events  and filter on user name or the user's sys_id.

[Sumanth16 · Accepted solution]

Hi ,

Go to the sys_audit(sys_audit.LIST) table, run the filter with your table name and add "field name" is deleted in the condition field. You can find all the deleted records.

 

Please mark it as helpful (or) correct if it fixes your issue.

Thanks,

Sumanth