Script to identify high-volume documentkey records in sys_auditSummary<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Find out which INC has over 10K of records in the sys_audit table. Need it to monitor if any API calls update too frequently on INC records or the like. Here INC (on the incident table) is just an example, it could be REQ, RITM, TASK ...etc. Just replace the table name in the code line with the other table name if needed. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All Instructions<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } How To Run Script Procedure========================== Note : Since sys_audit is very big, it will run for half to one hour. Please run it during non-business hours and test it on the non-prod instances to see how it works. Login to the instanceNavigate to System Definition > Scripts - Backgroundcopy and paste the script below.click [Run]When finished, you will see the output. And focus on the line with the format below. This is the INC record's sys_id (documentkey) you could use to search in the sys_audit table. This is also the element_id you could use to search the sys_journal_field table.*** Script: documentkey '<sys_id_value>' has 10005Explanation: This sample output above means documentkey '<sys_id_value>' has 10005 records in the sys_audit table.Ignore warnings from the script about the search table being too big.here is the script.....//-- cut below - here is the script// Script to get documentkey has more than 10000 records in sys_audit. You could modify line 6 and 8 to adjust 10000var generic = new GlideAggregate('sys_audit');generic.addQuery('tablename=incident');generic.addAggregate('COUNT', 'documentkey');generic.groupBy('documentkey');generic.addHaving('COUNT', '>', 10000);generic.query();gs.print('documentkey have more than 10000 records: ' + generic.getRowCount());var totalCount = 0;while (generic.next()) {var userCount = 0;var gr = new GlideRecord('sys_audit');gr.addQuery('tablename=incident');gr.addQuery('documentkey', generic.documentkey);gr.query();while (gr.next()) {userCount++;totalCount++;}gs.print('documentkey ' + generic.documentkey.getDisplayValue() + ' has ' + userCount);}gs.print('Total records: ' + totalCount);//----- End script