An event is something that happens to a task during its lifecycle.   The data related to an event can be found in audit logs, at the task level, or in related tables e.g. journal entries, attachments, approvals, etc.   The typical lifecycle of a task is defined as create time to closure time.   Events are defined by activities



An activity is a type of event.  Examples of activities in Service Management include;

  • The assignment group or state of an incident changing during the resolution of an incident
  • The SLA status of a task moving from in progress to breached
  • A change been marked as completed
  • The priority of an incident changing from Medium to High
  • Escalation of a task
  • Notifications
  • Journal entries
  • Approvals


Activity Type

Activity types represent the definition of activities.   Service Management activity types include;


Activity Type


Task - Timestamp

A timestamp related to a task e.g., created, re-assigned, re-opened, resolved

Task - SLA

An event related to a change of stage in the SLA lifecycle of a task. e.g., ‘Breached’, ‘Completed’, ’Paused’, etc

Audit - Event

A specific event recorded in the audit log e.g., priority changed, first assignment to an agent, second assignment group

Audit - Workflow

An event related to a workflow change e.g., change of assignment group, change of state


Events related to the entry of work notes, approval history or comments for a task


Events related to task approvals (requested, rejected, approved, etc)


Events associated with attachment activity during the lifecycle of a task


Note: Activity types may occur at the same time during the lifecycle of a task.   The Event Log Generator allows for these activities to be merged i.e., State changed to Work in Progress and Assignment Group are modified at the same time


Event Log Model


The definition of what data is required for the analysis of a certain process.   Attributes include;


  • The task table to analyse e.g., incidents, change requests, request items, etc
  • How to filter the task table (if applicable)
  • What timestamp represents the end of the task lifecycle e.g., for incidents, this is often the resolved timestamp as an incident typically closed automatically
  • What activity types to capture
  • The load type, full based on a date range or incremental (based on past x days)
  • The start and end label to be used in Variants (refer below)
  • The separator for activities e.g., ‘- ‘
  • Whether to merge activity occurrences that happen at the same time, and if so, the threshold in seconds
  • The names of export files and what task attributes to export
  • Scheduling details for generating export files


Event Log


The core output of the Event Log generator is an event log.  This can used for by Process Mining software for the purposes of process discovery, conformance and compliance checking, performance analytics, etc, or queried directly by ServiceNow reports or Business Intelligence software


A typical event log file consists of;




Task ID

The number associated with a task


Based on the what Activity Types are in a model and what the definition of each Activity type is


The timestamp related to the event determined by the activity type


The user associated with the event



The following is a sample event log;



INC1163106,State: Work in Progress- Group: CAD/BIM RDK,5/09/2020 3:11,

INC1163106,State: Resolved,5/09/2020 3:11,PM-Dennis Berner

INC1163106,State: Closed,10/09/2020 4:00,Ian Bradley

INC1163244,State: New- Group: Service Desk,5/09/2020 5:38,

INC1163244,State: Work in Progress,5/09/2020 8:31,PM-M J Jaikamal

INC1163244,State: Pending Internal,5/09/2020 9:08,PM-M J Jaikamal

INC1163244,State: Work in Progress,6/09/2020 9:08,Ian Bradley

INC1163244,State: Pending Internal,8/09/2020 0:52,PM-M J Jaikamal

INC1163244,State: Work in Progress,8/09/2020 1:29,PM-Markus Dahlberg

INC1163244,State: Resolved,8/09/2020 1:36,PM-M J Jaikamal

INC1163244,State: Closed,13/09/2020 2:00,Ian Bradley



A step is a transition from one activity to the next.  For example, an incident moving from New to Work in Progress.    A step can be associated with multiple variants (refer below) and exist in the workflow of 1 or many tasks.



A process variant is a sequence of process activities with a start event and a final event. The total number of converted process variants represents a process in this context. Each variant differs from the others by at least one activity. The various process variants can be mapped in one process model or in separate process models, whereby a single model represents the variants using several process paths. Process Mining automatically derives process variants of a process from the data. Any number of cases can run through one variant.


A loop in a process means that a certain process step is repeated more than once.   Loops are of interest in process analytics as they help to spot rework and inefficiencies in a process