Export Incident to xml, import loses order of activity stream

[Cort1]

I want to export some incidents to xml in our test environment, save them and re-import once we clone over from production on a monthly basis. I tried to export and import in our dev instance but noticed that all the comments and notes in the activity stream are no longer in the same order. The timestamp is not the same either, which is fine, but I was hoping the sequence would remain. It did not.

Have you experienced this?

[tim210]

Hi Allen,

You can see the Journal Entries by typing sys_journal_field.list into the navigation pane (on the left side of the page) and pressing enter. Same for sys_audit - sys_audit.list

The sys_audit records will have this layout:

oldvalue: 'JOURNAL FIELD ADDITION'  

newvalue: (the content of the work note/comment)

fieldname comments

documentkey the sys_id of the record (i.e. the incident, change request or whatever)

sys_created_on the created on time of the sys_audit record is used as the time for the comment/worknote when shown in the incident/change/whatever page. If the sys_audit record is missing it'll default to the sys_created_on of the Task record (incident/change/whatever)

The sys_journal_field records:

Name: Name of the table that this Journal Entry is associated with, e.g. Incident[incident]

Element: Additional Comments OR Work notes

Value: The actual comment/work note content

Element ID: sys_id of the record (i.e. the incident, change request or whatever)

Can you check both the sys_audit and sys_journal_field records for one of these comments and confirm what the sys_created_on value is on the sys_audit record? And also what the sys_created_by is on both records?

[Allen Andreas]

Hi Tim,

Thank you very much for attempting to help me.

So, I am only testing this with one incident right now. I went in to the incident and then right-clicked the header gray bar to go to History > List and I got the document key (I'm assuming I need this to find relevant records within the thousands that exist in sys_audit and the journal).

I went to sys_audit and searched by this document key and I see this:

It appears as if a lot of the data is being deleted? Not sure if that means there's something wrong with the field name coming across etc, but there's that for this incident. And for the sys_journal_field:

So these appear to be the comments and these do show up on the incident that I'm testing with. The created date is correct and matches when they actually posted it in the incident, but then on the incident it shows like this:

More or less and essentially it shows as if Melissa Bryon is talking to herself (doesn't show the name of anyone else even though there Lynn Thomas and Kelly Crown involved in all this chatter) and the time stamp is the same for ALL of them which is the 1-18-18 at 5:19PM.

Any thoughts?

[Allen Andreas]

Also to provide a bit more information...it looks like whatever date populates in the Opened box here is where that specific timestamp is coming from (that's my theory):

[tim210]

I'm not sure how to change the user, I tried changing a couple of fields in sys_journal_field and sys_audit on a test instance but couldn't get anything to change. I'll experiment a bit more and see how it works.

[Allen Andreas]

Thanks Tim,greatly, for trying to help with this.

I'm curious if there is some permission issue with the sys_audit. I had tried to give admins create/write/read etc. to the entire table like sys_audit.* and tried to reimport the xml file again and there was no success.

I say that because in the sys_audit most of the stuff says "DELETED" as if it can't cross over?

I've opened the xml file that contains just the one incident from my other instance in an xml editor and can see that all the data is there (actions/names, etc). So it's definitely something in our enterprise instance that's blocking something.