O11y Synthetics UI throwing the error "Oops, it looks like something went wrong".

Applicability

Description

When trying to access the failed test results page, synthetics UI throws the error message "Oops, it looks like something went wrong. The page you are looking for might have been removed, had its name changed or is temporarily unavailable."

Investigation

To troubleshoot this issue :

• Open the UI in Incognito/Private mode and test again.
• Try accessing the Synthetics UI using a different browser.
• Clear the browser cache and try accessing the UI again.
• If the issue still persists, review and collect the browser console logs.
• Capture a HAR file from the UI after reproducing the issue.
• Verify network connectivity.
• Confirm that the SignalFx endpoints are whitelisted.
• Try accessing the Synthetics UI without the VPN to check whether the VPN is causing the issue.
• Verify whether any firewall or proxy settings could be blocking access.

After reviewing the console logs and HAR file, 403 Forbidden errors were consistently observed when attempting to retrieve synthetic test artifacts for that time period.

Analysis of the response observed when accessing the page source artifact from the Synthetics test confirms that it is not originating from the Splunk Observability backend. The response is being generated by the network security layer (Zscaler), which is intercepting and replacing the original response.

The response header includes:

{
  "name": "Server",
  "value": "Zscaler/6.2"
}

Specifically, Zscaler is blocking the response with the reason:
“IPS block inbound response: phishing content”:

Resolution

What is happening behind the scenes :

The Synthetics feature allows the captured HTML of the tested page to be downloaded. In this case, the captured content includes common login-page elements such as forms, password fields, and scripts.

That artifact is served from the Observability domain rather than the original tested site. Because of this, the network security layer (Zscaler) inspects the response and may classify it as phishing-like content, since it appears to be a login page coming from a different domain.

As a result, Zscaler blocks the original response and replaces it with its own block page.

The request itself is valid and reaches the backend successfully. The response is altered only after it leaves the service, by the network security layer.

Resolution : 

To allow access, create an exception (allowlist rule) in Zscaler for the Synthetics artifact URL path.

The exception should permit responses even when the content includes HTML that looks like a login or authentication page, since this is expected for captured page source artifacts.

Workaround

As a temporary workaround, access the artifact outside the Zscaler-inspected path, such as:

• without VPN
• with Zscaler bypassed or disabled, if allowed by policy.