We recently had an issue with something that required running a script to fix some values that had been incorrectly changed. The correct data we needed was in the sys_audit table, but getting to the table to verify that the data really was there turned out to be a miniature adventure all on its own.
The table checkpoints changes to nearly any field an any given form, so it’s huge. My mistake initially was in not thinking about how such a huge table can be so responsive when viewed from a form (in the history/activities section), but so slow when I’m trying to get at the records from a list view.
I’m used to tables in ServiceNow being indexed by one or more date/time fields, but obviously, that’s not how the data is being accessed from the forms.
All indications are that the sys_audit table is indexed by the documentkey field (the sys_id of the record being checkpointed or audited).
In keeping with my theme of also blogging about stuff that I’ll need to lookup at some point in the future, here is the url to get at all of the entries for a given record:
https://[instance].service-now.com/nav_to.do?uri=%2Fsys_audit_list.do%3Fsysparm_view%3D%26sysparm_first_row%3D1%26sysparm_query%3Ddocumentkey%253D[sys_id]%26sysparm_list_mode%3Dgrid%26sysparm_offset%3D
You’ll need to update the [instance] and [sys_id] with the correct fields