Skip to main content

Transaction Logs

Sync Type: Incremental

Overview​

The ServiceNow Transaction Logs input fetches data from the ServiceNow Table API. ServiceNow maintains comprehensive audit trails to track system-level operations for compliance and security purposes. This input accesses data from the syslog_transaction table, which records transaction logs of administrative activities, system operations, and bulk data modifications, including the user, timestamp, operation type, and affected records.

⚠️ Note: Querying the syslog_transaction table via the ServiceNow Table API creates new transaction log entries. This means each data fetch from this input will generate additional records in the syslog_transaction table. This is expected ServiceNow behavior and does not indicate an error. Users should be aware that continuous polling will result in ongoing growth of this table.

Prerequisites​

Portal setup​

  1. Login to your ServiceNow Instance.
  2. Navigate to Users
    • Click on All option and type Users. Select Users option from under System Security > Users and Groups.
  3. Create a New User
    • Fill out the details, most importantly First name, Last name and Email. Click Submit to save the info.
    • Click on New button to add a new User record.
  4. Locate the new user
    • Find the newly created user in the users list.
    • Click on the UserID to open the user record details.
  5. Assign Roles
    • In the user record details, a new "Roles" tab will appear at the bottom.
    • Click on "Edit" under the Roles tab, which will open a new page with all available roles.
    • For the Table API, you can either add all admin roles for the tables you want to retrieve data from or add the "general" admin role to give access to all tables.
    • Save the changes.
  6. Set Password
    • Return to the user record.
    • You will see a "Set Password" button next to the update and delete button.
    • Click the Set Password button, which will open a popup.
    • Click the "Generate" button inside the popup to create a password, then click "Save Password".
  7. Instance Name
    • Note the instance name of the ServiceNow instance for use in later steps. For example, if the URL to your ServiceNow instance is https://test-demo.service-now.com, the instance name will be test-demo.

OAuth Setup​

⚠️ Important: Before setting up OAuth make sure you have security_admin role.

  1. Navigate to System OAuth > Application Registry.
  2. Click New and then click Create an OAuth API endpoint for external clients.
  3. Enter the name of the client and click the Submit button to generate Client Secret.
  4. Once generated note down Client ID and Client Secret.

Configuration​

SettingTypeRequiredDescription
Instance namestringtrueInstance name found in URL of your ServiceNow instance
UsernamestringtrueYour ServiceNow instance username.
PasswordstringtrueYour ServiceNow instance password.
Client IDstringtrueClient ID of the application created in the Application Registry while setting up OAuth.
Client SecretstringtrueClient ID of the application created in the Application Registry while setting up OAuth.
Backfill start timestringNoThe date to start fetching data from. If not specified, no past records will be fetched.

Sample Record​

{
    "acl_time": "",
    "additional_debug_info": "",
    "additional_info": "consectetur excepteur non dolore laborum non magna ut consequat veniam dolore amet ullamco magna laborum qui reprehenderit enim qui ex esse anim adipiscing cupidatat mollit ea velit pariatur dolor dolore adipiscing in cillum veniam nulla eu qui velit cillum anim dolore consequat dolor esse qui fugiat officia nulla mollit sed",
    "ajax_transaction_count": "",
    "app_scope": "",
    "browser_time": "",
    "business_rule_count": "3",
    "business_rule_time": "1",
    "client_network_time": "442",
    "client_response_time": "",
    "client_script_time": "",
    "client_transaction": "true",
    "clotho_count": "",
    "clotho_time": "",
    "cpu_time": "983",
    "cpu_usage": "0.01",
    "db_category": "",
    "db_pool": "",
    "gzip": "true",
    "has_call_chain": "true",
    "interaction_id": "87d729de-0634-6ed0-dde1-02df372f98c0",
    "largest_chunk_written": "819",
    "largest_input_read": "17",
    "network_time": "1",
    "origin_scope": {
        "link": "https://test-xyz.service-now.com/api/now/table/sys_scope/cfc6ea60-9fa6-e1f3-0175-47b8ab997740",
        "value": "7affab3d-1dc0-5dce-45ac-61933cba02c3"
    },
    "output_length": "692",
    "parent": "",
    "phase1_form_length": "0",
    "potential_cpu_time": "1525",
    "protocol": "HTTP/1.1",
    "referer": "",
    "remote_ip": "211.130.149.56",
    "render_size": "48169",
    "request_param_size": "60",
    "response_time": "713",
    "semaphore_wait_time": "0",
    "session": "",
    "session_wait_time": "40",
    "sql_count": "9",
    "sql_time": "10",
    "start_process_at": "2025-10-14T08:30:03.914Z",
    "start_process_at_ms": "1760430603914",
    "sys_created_by": "admin",
    "sys_created_on": "2025-10-14T08:30:03.913Z",
    "sys_id": "f1453d98-41ff-bd12-0168-19f74640c3e2",
    "system_id": "8d0641e4-e88e-14b3-1718-dcd6e159b113",
    "table": "",
    "total_page_load_time": "",
    "total_wait_time": "38",
    "transaction_number": "TX18",
    "transaction_pattern": {
        "link": "https://test-xyz.service-now.com/api/now/table/sys_transaction_pattern?hash=abx123",
        "value": "abx123"
    },
    "transaction_processing_time": "962",
    "type": "rest",
    "ui_policy_time": "",
    "url": "",
    "user_agent": "Chrome/138.0.",
    "view_id": "4dad9b33-4dc9-4d00-d581-88dfcf663b5a"
}