The Activity stream on the incident record is showing the end user's comments in internal work notes, and showing the same entry multiple times with the same timestamp as the incident record creation time.

All Releases

The Activity Stream is populated with the entries from the sys_history_set table, this table data is populated from the sys_audit table. The affected incident record had a lot of entries in the sys_history_set table but most of them were not available on the sys_audit table. You can find this difference going through these URLs:

/sys_audit_list.do?sysparm_query=documentkeySTARTSWITH<sys_id of affected incident record>

/sys_history_set_list.do?sysparm_query=idSTARTSWITH<sys_id of affected incident record>

If it is a one-off issue with a single record, you can perform below action to work-around the issue:

• Go to the affected incident record
• Right-click on the form header > History > List, this will open a record history with an option to "Update" or "Delete"
• Click on "Delete"

So that sys_history_set would be repopulated from the sys_audit table again so that both tables will be in sync.

If the issue observed in a bigger level, for example, a lot of task records are affected, please open a case on (Now Support HI) in the category  "Audit History", so that customer support will assist you with identifying why the audit records are missing and will help you with recovery.

• Differences Between Audit and History Sets
• History Sets
• Viewing catalog item audit history