Any way to show the who, when, and where a ticket number was assigned?

[zerofidelis]

Hey All!

Going to try and explain this the best I can.

Our leadership is asking why a specific INC number is missing from the Incident table.  I have tried to explain that ServiceNow assigns ticket numbers when an INC is created, but that ticket number may not be inserted into the table until that ticket is submitted, which can lead to gaps in the sequential numbering if someone creates a ticket, then navigates away, doesn't need it anymore, leaves it open until they are logged out, and the ticket never gets submitted.

Two Questions:

1. Can someone fact check me that I am correct in how ServiceNow handles assigning numbers to tickets across the tables and that what I am saying is the likely cause is in fact correct.

2. The inevitable question was then asked, how do we prove that was what happened (As this is tying back to an audit request).  I have dug through the event table, however, the ticket in question was from June of 2024 and I only see around 2-weeks of log data stored on our instance.  Is there anywhere I can go to find the who, what, when, where around when each ticket number is assigned, even if it is not inserted into the table?  Or does anyone have any other ideas of how I could satisfy this request?

Thanks in advance!

[Brian Bouchard]

Your explanation is a possible cause, but as you indicated, without the logs, I don't believe there is a way to prove this was the case.

For future reference, I believe you can update the behavior of when the number is assigned by following the following post suggestion:
https://www.servicenow.com/community/developer-forum/auto-assign-incident-number-onsubmit-instead-of...

The post is several years old, but I believe it still holds true. Test to verify.

[zerofidelis]

Hey Brian,

Thanks for the suggestion, it is a great idea that may very well work to "Solve" the issue moving forward, however, it doesn't help me with regards to this specific question on if there is any specific place or log repository that I'm just not aware of that can show definitively what happened with the specific ask.

[Bert_c1 · Accepted solution]

Node logs go back 30 days at most. So unless you have a "skipped" number withing that time, there is no way to determine who didn't submit the record with the skipped number. To prevent this, set the system property mentioned in Brian's post.