Retrieve Incidents after a given sys_updated_on

[dattas]

Hi,

I am polling ServiceNow after a certain time interval through REST API to retrieve newer Incidents. During every poll, I am passing the sys_updated_on value of last Incident. However, the query is not working. Can someone provide a sample query?

[Ankur Bawiskar]

@dattas 

if you are using OOTB table API then you can pass this in sysparm_query

something like this

GET https://instanceName.service-now.com/api/now/table/incident?sysparm_query=sys_updated_on>javascript:gs.dateGenerate('2026-08-14','10:00:00')

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[ShivaliS]

If you're polling ServiceNow for incremental Incident updates, use the sys_updated_on value from the last record processed and use it in your next query:

GET https://<instance>.service-now.com/api/now/table/incident?sysparm_query=sys_updated_on>javascript&colon;gs.dateGenerate('2026-08-17','09:00:00')&sysparm_orderby=sys_updated_on&sysparm_limit=100

You can also use:
GET https://<instance>.service-now.com/api/now/table/incident?sysparm_query=sys_updated_on>=2026-08-17 09:00:00

A couple of things to watch out for:

Ensure the date/time format matches what ServiceNow expects.
sys_updated_on is stored in UTC, so timezone differences can cause records to be missed if your polling application uses local time.
Sort by sys_updated_on and persist the latest timestamp returned after each poll.
If multiple records can share the same sys_updated_on value, consider tracking both sys_updated_on and sys_id to avoid missing records between polls.

For fixed time windows, encoded queries such as:

GET https://instanceName.service-now.com/api/now/table/incident?sysparm_query=sys_updated_onONLast%202%2...
are also valid, but they are generally not recommended for delta polling integrations.