Delete or edit a "bad" comment or work note

[CapaJC]

Possible, but intentionally not easy. Don't want folks rewriting history willy nilly.
1) Find the sys_id of the incident. Do this by right-clicking and "Copy URL". The sys_id is the 32 characters immediately following "sys_id="
2) Go to the sys_journal_field table. You can get there using the URL (make it specific to your instance instead of /demo): http://www.service-now.com/demo/sys_journal_field_list.do
3) Filter where element_id = (the sys_id of your incident).
4) That should give you all journal comments/work notes for that incident. Delete or edit the bad one.

A better URL to use might be (to prevent possibly killing your instance and requiring a restart):
https://www.service-now.com/demo/sys_journal_field_list.do?sysparm_query=element_id=a9e9c33dc6112276...
Where you replace the last 32 characters with your sys_id, and use the URL for your instance instead of /demo.

--J

[CapaJC]

Some have pointed out that this doesn't affect the comment in the activity formatter. Correct! That info is pulled from the sys_audit table, which requires even more care to edit. The wrong query (i.e., an unindexed one) on sys_audit can lock up your instance requiring a restart. Do that in product, and I don't wanna be you.

But here's how 🙂 Similar to the URL before for sys_journal_list, here is the query to give you all sys_audit entries for a single record. Note that the documentkey field is indexed, so this is relatively safe. It's essentially the same query we do when you view the history of a record (replace the 32-character hex string with the sys_id of your botched record, and again use your instance instead of /demo):
https://demo.service-now.com/sys_audit_list.do?sysparm_query=documentkey=a9e9c33dc61122760072455df62663d2

Edit with care and with eyes wide open. Messing with sys_audit can probably get you in serious trouble in some organizations. Don't do anything you wouldn't do if your mom and your boss were sitting over your shoulders.

[gma]

After deleting/ modified the entry(commnets) of incident table  in Sys_audit table ,the same data not reflected in incident table.

Old data still showing in incident.

[Riddel]

This one could use a little refresh. Here are the steps to delete any work notes or other activity in the June11 release (and beyond?):

TO REALLY DELETE ANY ENTRY IN THE ACTIVITY:
1. Get the sys_id of the incident
2. Get the audit_sysid of the exact entry you want to delete by going to History and click through the specific entry
3. Delete 3 entries using the following url's:
    a. Use sys_id: https://yoururl.service-now.com/sys_journal_field_list.do?sysparm_query=element_id=yoursysid
    b. Use sys_id: https://yoururl.service-now.com/sys_audit_list.do?sysparm_query=documentkey=yoursysid
    c. Use audit_sysid: https://yoururl.service-now.com/sys_history_line_list.do?sysparm_query=audit_sysid=yourauditsysid

[Arlen]

Riddel

Just a minor amendment to point 'C' above:

It appears the powers that be have removed the 'Delete' button from the 'sys_history_line' form so in order to delete the records:
- Navigate to the global delete UI action for 'delete record'
- Perform an 'insert and stay'
- Change the table to 'History [sys_history_line]'
- Remove the conditions
- Update the UI action and voila!

As always, use caution peeps when deleting records 🙂