Instance Drift

What it does

Something broke on Monday and it worked on Friday. This tells you what changed in between, and who changed it.

Update sets only tell you about work somebody deliberately captured into one. This is everything else: the property nudged in production, the business rule switched off, the access control that quietly appeared, the scheduled job whose script was edited at 6pm.

Every customizable record on a ServiceNow instance records who last touched it and when. There is no screen in the platform that shows you all of them together. This is that screen.

Why nobody has just looked at this before

Because the raw answer is unusable.

On the instance this was built against, thirty days held 10,588 changed records. That is not a report, it is a wall. Reading it is worse than not looking, because the change you care about is in there somewhere with three thousand pieces of help-text housekeeping on top of it.

Two filters turn that into something a person can read:

Everything - 10,588 Configuration only - 992 Configuration, by a human - 39

Thirty-nine is a list you can read over coffee. Ten thousand is not.

Both filters are switches on the report, so you can always see exactly what is being kept from you. A tool that hides things without telling you is one you stop trusting the first time it hides the wrong thing.

What counts as configuration

Business rules, script includes, client scripts, access controls, UI policies and actions, system properties, dictionary entries, tables, scheduled jobs, notifications, roles, transform maps, scripted REST resources, processors, UI pages, reports, relationships, data policies, email templates, choice lists, views, list and form layouts, and workflows.

Not embedded help content, guidance, documentation or interface assets — which is what the other 9,596 records were.

It reports itself, unless you tell it not to

In that same thirty-day window this application's own records accounted for 126 rows, because installing it is itself a change to the instance.

A drift report whose top result is the drift report would be a mirror, so its own scope is excluded by default — and there is a switch to include it, because hiding something without saying so is how a tool loses your confidence.

Four things it will not do

It cannot change anything. There is no write path in this application at all — not disabled, not behind a flag. That is not a promise in a document, it is a test in the shipped ATF suite that reads every script in the application and fails if any of them can write.

It does not tell you what changed inside a record. It reports that a record changed, who changed it and when. For the before-and-after of a particular field, the platform's own history on that record is the right tool and it is already there.

It stores nothing. No tables ship with it. Every answer is worked out when you ask for it and thrown away when you close the page, so there is nothing at rest, nothing to corrupt, nothing to export before removing it, and an uninstall that cannot leave residue because there is none to leave.

It does not start the clock when you install it. The timestamps it reads were already on your instance, so the first report covers the last ninety days whether it was installed this morning or last year.

A sentence, not a score

The report ends with a sentence: how many configuration records changed, over what window. Not a number out of a hundred.

A score invites a threshold, a threshold invites somebody deciding that eleven is acceptable, and after that nobody reads the detail again — which was the whole point.

Where it stops

It reads at most 500 rows in one go and says so plainly when it has. A busy instance is exactly the estate this is meant to help, and walking all of it is how a diagnostic becomes the outage it was installed to investigate.

When it stops early it tells you the number it stopped at and suggests narrowing the window, rather than handing you a prefix that reads like the whole answer.