Reporting & Dashboards
Reports Overview
ServiceNow reports allow administrators and users to visualize data stored on the platform. Reports are created against a table or data source, filtered by conditions, and rendered in a variety of chart or list formats. They are stored in the sys_report table.
- Reports are stored in:
sys_reporttable - Navigate to: Reports > View/Run or type
sys_report.listin the filter navigator - Create a new report: Reports > Create New
- Reports can be run on-demand, scheduled, or embedded in dashboards
- Report scope controls whether a report is global or application-specific
Report Types
ServiceNow supports a wide range of visualization types. Knowing when each type is appropriate is exam-testable.
List
Displays records in a flat table format — similar to a standard list view. Best for record-level detail without aggregation.
Example: All open incidents assigned to a specific group.
Bar Chart
Aggregates data into vertical or horizontal bars grouped by a categorical field. Supports a secondary "Stack by" grouping.
Example: Incident count grouped by Priority.
Pie Chart
Shows proportional distribution of a single grouping as slices of a circle. Best for ≤6 categories.
Example: Percentage of incidents by State.
Donut
Identical to a Pie Chart but with a hollow center — often used to display a total count in the center ring.
Example: Open vs. Closed incidents with total in the middle.
Line
Plots data points connected by lines over a continuous axis. Ideal for showing trends over time.
Example: Incident volume per week over the last quarter.
Trend
Time-based bar or line chart that requires a date field for grouping. Groups records by day, week, or month.
Example: Monthly change request volume for the past year.
Histogram
Displays frequency distribution of numeric data across defined range buckets (bins).
Example: Distribution of incident resolution times.
Heatmap
Two-dimensional grid using color intensity to represent the magnitude of values at the intersection of two dimensions.
Example: Incident count by Day-of-Week vs. Hour-of-Day.
Pivot Table
Cross-tabular analysis showing values at the intersection of row and column groupings — similar to a spreadsheet pivot table.
Example: Incident count by Assignment Group (rows) × Priority (columns).
Calendar
Plots records on a calendar grid based on a date field — useful for visualizing scheduled events or due dates.
Example: Change requests plotted by scheduled start date.
Map
Geospatial visualization that plots records on a geographic map using location data fields.
Example: Asset locations plotted on a world map by location field.
Creating a Report — Core Steps
The standard flow for building a report in ServiceNow follows a consistent four-step pattern:
| Step | What You Configure | Notes |
|---|---|---|
| 1. Table | Choose the source table or data source | E.g., incident, change_request, cmdb_ci |
| 2. Conditions | Apply filter conditions to narrow down records | Dot-walking is supported for related table fields |
| 3. Group By | Select the field to categorize or group records | Drives the x-axis or slices in chart reports |
| 4. Display | Choose columns, aggregates, and visual options | Set chart type, colors, and legend options here |
Report Scope: Global vs. Application
Global Scope
Report is available across the entire ServiceNow instance. Visible to all users who meet the sharing criteria, regardless of the application context they are in.
Application Scope
Report is scoped to a specific application or update set. Only visible when working within that application's context. Used for scoped app development.
Report Builder Anatomy
The Report Builder is the primary interface for creating and editing reports. Each configuration field within the builder has a distinct purpose — understanding them precisely is key to answering exam scenario questions correctly.
Source: Table vs. Data Source
Table Source
Pulls records directly from a single ServiceNow table. Most common source. You specify the table name (e.g., incident) and apply conditions on top of it.
Data Source
A pre-defined, reusable query configuration stored in the sys_data_source table. Allows joining multiple tables, applying complex filters, and reusing the same data set across multiple reports.
Key Report Builder Fields
| Field | Purpose | Supported On |
|---|---|---|
| Filter Conditions | Restricts the dataset using condition builder logic. Supports dot-walking to traverse reference fields to related tables. | All report types |
| Group By | The primary categorical dimension — groups records by a field value (e.g., Priority, Assignment Group). Becomes the x-axis label or pie slice. | Bar, Pie, Donut, Heatmap, Pivot |
| Stack By | A secondary grouping applied within each Group By bucket. Produces a stacked or clustered bar chart with a second dimension. | Bar Chart only |
| Trend By | Time-based grouping that slices data by date intervals: Daily, Weekly, Monthly. Requires a date/datetime field. | Trend, Line reports |
| Aggregate | The mathematical function applied to the grouped data. See aggregate types below. | All aggregate report types |
| Visible to | Controls who can view the report: Me (personal), Groups, Roles, or Everyone. | All report types |
Aggregate Functions
The Aggregate field determines how grouped records are measured. Choosing the wrong aggregate is a common source of incorrect exam answers.
Total number of records in each group, including duplicates.
Count of unique values for a specified field within each group. Removes duplicates.
Adds up numeric field values across all records in a group.
Calculates the arithmetic mean of a numeric field across the group.
Returns the smallest numeric value of the specified field within the group.
Returns the largest numeric value of the specified field within the group.
Dot-Walking in Report Conditions
Dot-walking allows report conditions to traverse reference fields and filter on fields from related (parent or child) tables. This is a powerful feature that makes it possible to filter incidents by the caller's department without needing a separate join.
// Filter incidents by the caller's department (dot-walk through caller_id → sys_user → department)
caller_id.department = "IT"
// Filter incidents by the assignment group's manager (dot-walk through assignment_group → sys_user_group → manager)
assignment_group.manager = "John Smith"
// Filter CIs by their location's city (dot-walk through location → cmn_location → city)
location.city = "New York"
caller_id.department.head.name). However, deep dot-walking can impact report performance on large tables. For the exam, know that dot-walking is supported in report filter conditions and that it traverses reference fields.
Dashboards
Dashboards are visual workspaces that aggregate multiple reports and data widgets on a single configurable canvas. They provide at-a-glance operational visibility without requiring users to run individual reports.
- Navigate to: Reports > Dashboards or search "Dashboard" in the filter navigator
- Dashboards are built by adding Widgets to a layout grid
- Each dashboard can have multiple Tabs to organize widgets by category or audience
- Dashboards support real-time or periodically refreshed data
Widget Types
Report Widget
Embeds an existing saved report directly on the dashboard. The report renders in its configured chart or list format. Clicking through a report widget can drill down to the underlying records.
Number Widget
Displays a single count or aggregate value prominently — typically a large number with a label. Ideal for KPIs like "Open P1 Incidents" or "SLA Breaches Today."
Gauge Widget
Displays a value on a dial or gauge scale — useful for showing progress toward a target (e.g., SLA compliance percentage). Supports configurable thresholds for color-coded status.
Clock / Custom
ServiceNow also supports clock widgets for displaying current time in different time zones, and custom HTML/URL widgets for embedding external content.
Dashboard Sharing
Dashboards have a Sharing configuration that determines who can view and edit them. This is separate from report-level "Visible to" settings.
| Sharing Level | Who Can See It | Use Case |
|---|---|---|
| Personal | Only the dashboard owner | Private work dashboards; personal monitoring views |
| Group | All members of specified ServiceNow groups | Team-level operational dashboards shared with a squad or department |
| Roles | All users who have the specified role(s) | Role-based visibility — e.g., all users with the itil role see the IT Ops dashboard |
| Everyone | All authenticated users on the instance | Company-wide status dashboards, public announcement boards |
Tab Management
Dashboards support multiple tabs, allowing you to organize widgets logically within a single dashboard. Each tab has an independent layout and can display a different set of widgets.
- Add a new tab via the + icon on the dashboard tab bar
- Tabs can be renamed, reordered, and deleted independently
- Each tab can have its own sharing configuration (in newer ServiceNow versions)
- Tabs are useful for separating views — e.g., "Overview," "SLA Status," "Team Performance"
Interactive Filters on Dashboards
Interactive Filters allow dashboard viewers to slice all applicable widgets simultaneously without modifying the underlying reports. They act as a dynamic cross-dashboard filter.
- Added to a dashboard as a widget — appears as a dropdown or date picker at the top of the canvas
- When a user selects a value (e.g., "Priority = 1 - Critical"), all widgets that use the same source table and field update dynamically
- Interactive filters are not saved to the underlying reports — they are temporary view-time overrides
- Useful for executive dashboards where stakeholders need to filter by date range, region, or team without creating separate reports
Performance Analytics (PA)
Performance Analytics (PA) is a licensed ServiceNow application that extends standard reporting with historical data collection and time-series trending. While standard reports reflect the current state of data, PA captures point-in-time snapshots and tracks how metrics evolve over time.
Core PA Concepts
Indicators
The metric definitions that PA tracks. An indicator describes what to measure — for example, "Count of open P1 incidents." Indicators are configured with a source table, a filter condition, and an aggregate function.
Stored in: pa_indicators table
Scores
The actual point-in-time value of an indicator, collected by a scheduled data collection job. Every time the job runs, it records the current value of the indicator as a Score. Scores accumulate over time to build a historical trend.
Stored in: pa_scores table
Breakdowns
A dimension by which an indicator's score can be further sliced. A Breakdown defines a segmentation — for example, "by Assignment Group" or "by Priority." Enables drilldown from total to segmented views.
Stored in: pa_breakdowns table
Targets
A desired value for an indicator — defines what "good" looks like. For example, a target of 10 for "Open P1 incidents" means you want to keep that count at or below 10.
Thresholds
Warning and critical boundaries for an indicator's value. Used to drive color-coded status on gauge widgets — green (good), yellow (warning), red (critical). Thresholds trigger visual alerts when values cross defined limits.
Data Collection Jobs
Automated scheduled jobs that collect scores for indicators at defined intervals (e.g., daily). Without a data collection job running, PA indicators have no historical score data.
Navigate to: Performance Analytics > Data Collector > Jobs
PA vs. Standard Reports — Critical Comparison
This comparison is one of the most commonly tested topics in the reporting section of the CSA exam.
| Aspect | Standard Reports | Performance Analytics (PA) |
|---|---|---|
| Data Reflects | Current state of live data at the time of report execution | Historical point-in-time snapshots collected by scheduled jobs |
| Historical Trending | Limited — Trend report shows current table data grouped by date field, but records that are deleted or updated are reflected at current values | Full — PA captures scores at the time of collection regardless of subsequent record changes |
| License | Included with all ServiceNow instances | Requires separate Performance Analytics license |
| Best For | Current operational state: open incidents, today's changes, current inventory | KPI trending over time: how has MTTR changed month-over-month? Is our incident backlog growing? |
| Data Capture | On-demand query — no pre-collection needed | Requires scheduled data collection jobs to have run — no historical data without them |
| Typical Use | Operational lists, ad hoc queries, form-based reports | Executive dashboards, SLA trend analysis, continuous improvement tracking |
Automated Data Collection Jobs
PA data collection jobs are scheduled system jobs that automatically run at configured intervals to capture indicator scores. Key facts:
- Jobs are configured under: Performance Analytics > Data Collector > Jobs
- Each job is associated with one or more indicators
- Jobs can be triggered manually or run on a schedule (daily, weekly, etc.)
- If a job has never run, there are no scores and no historical data to display
- Backfilling historical scores is possible but requires a data collection job with a historical range configured
Scheduled Reports
Scheduled Reports automatically run a report on a defined interval and distribute the output to specified recipients via email. This eliminates the need for users to manually run reports on a recurring basis.
- Scheduled reports are stored in the
sys_report_scheduletable - Navigate to: Reports > Scheduled Reports or type
sys_report_schedule.list - A scheduled report is associated with one or more existing saved reports
- The schedule runs a fresh query against the live data at the configured time
Schedule Configuration
| Field | Description | Options / Examples |
|---|---|---|
| Frequency | How often the report is sent | Daily, Weekly, Monthly, Once |
| Run time | The time of day the scheduled job executes | E.g., 06:00 AM UTC |
| Recipients — Users | Specific ServiceNow users to receive the report | Reference to sys_user records |
| Recipients — Groups | All members of specified ServiceNow groups receive the report | Reference to sys_user_group records |
| Recipients — Email Addresses | Free-text email addresses — can include external addresses outside ServiceNow | E.g., manager@company.com |
| Format | Output format of the emailed report attachment | PDF, Excel (.xlsx), CSV, PNG |
sys_report_schedule under the hood but differ in who initiates the subscription.
Data Sources
A Data Source is a reusable, pre-configured query definition that can serve as the basis for one or more reports. Instead of configuring the same table, joins, and filters on each report individually, a Data Source encapsulates that configuration and allows multiple reports to share it.
- Data Sources are stored in the
sys_data_sourcetable - Navigate to: Reports > Data Sources
- A Data Source can reference a single table or use dot-walking to traverse related tables
- Complex multi-table relationships can be modeled using dot-walked fields as virtual columns
Joining Tables via Dot-Walk
ServiceNow does not have native SQL-style JOIN syntax for reports, but dot-walking through reference fields effectively achieves the same result. A Data Source based on the incident table can expose caller_id.department, caller_id.location.city, and assignment_group.manager.name as available fields — bringing in data from related tables transparently.
// Example Data Source on incident table exposing cross-table fields via dot-walk
Source Table: incident
Available dot-walked fields:
caller_id.name → Caller's full name (from sys_user)
caller_id.department.name → Caller's department name (from cmn_department via sys_user)
assignment_group.name → Assignment group name (from sys_user_group)
assignment_group.manager.name → Group manager name (from sys_user via sys_user_group)
location.city → Location city (from cmn_location)
Encrypted Tables and Report Restrictions
ServiceNow supports field-level encryption for sensitive data. Reports on tables with encrypted fields are subject to the following restrictions:
- Encrypted fields cannot be used as Group By dimensions — the encrypted value cannot be aggregated or compared meaningfully
- Encrypted fields cannot appear in report filter conditions unless queried with the exact encrypted hash
- Users without the encryption key or appropriate role will see masked or blank values for encrypted fields in report output
- Report administrators should be aware of these constraints when designing reports against HR or financial tables that use encryption
Key Exam Facts & Traps
This section consolidates the highest-frequency exam facts for the Reporting & Dashboards topic. Review these before the exam.
sys_report table. Scheduled report definitions are stored in sys_report_schedule. Data sources are in sys_data_source. Know these table names — they appear in exam questions about navigating to or auditing reports.
incident will show the current open count right now. A PA indicator score from last Tuesday will show the open count as it was last Tuesday — even if those records have since been resolved or deleted.
Quick Reference Summary
| Topic | Key Fact |
|---|---|
| Reports table | sys_report |
| Scheduled reports table | sys_report_schedule |
| Data sources table | sys_data_source |
| Trend report requirement | Must have a date/datetime field for "Trend by" |
| Pivot Table use case | Cross-tab / matrix analysis (rows × columns) |
| Stack by | Secondary grouping on Bar Charts only |
| PA vs. Reports | PA = historical trending; Reports = current state |
| PA license | Required (add-on); standard reports are base platform |
| Scheduled report formats | PDF, Excel (.xlsx), CSV, PNG |
| Report edit access | Creator + admin only by default |
| Dashboard vs. Homepage | Dashboards are modern; Homepages are legacy |
| Interactive Filters | Cross-dashboard dynamic filters; do not save to reports |
| PA Indicator | What to measure (metric definition) |
| PA Score | Point-in-time value collected by a data collection job |
| PA Breakdown | Dimension to slice an indicator (e.g., by Priority) |
- Proportion/Share → Pie or Donut
- Category comparison → Bar Chart
- Category + sub-category comparison → Bar Chart with Stack by
- Trend over time → Trend or Line (requires date field for Trend)
- Frequency distribution of a number → Histogram
- Two-dimensional density → Heatmap
- Row × Column cross-analysis → Pivot Table
- Record-by-record detail → List
- Events on a calendar → Calendar
- Geographic distribution → Map