Synthetic alert email - "failure screenshot" link throwing access denied error

Applicability

Description

For all Splunk Synthetics Critical Alert emails, the link to the Failure screenshot directs users to an error page displaying an XML error message:

AccessDenied
Request has expired

Investigation

1. Confirm the error by clicking the Failure screenshot link in a Splunk Observability Critical Alert email.
2. Observe the XML error message indicating "AccessDenied" and "Request has expired".
3. Verify the timestamp on the URL expiration and compare it to the current server time.
4. Confirm that the screenshot is still accessible via the Splunk Observability Cloud UI by navigating to the synthetics test and viewing the run results for the failed run.

Resolution

1. Understand that the expiration of the Failure screenshot link in alert emails is expected behavior due to AWS S3 pre-signed URL security policies.
2. Access the screenshot directly from the Splunk Observability Cloud UI:
- Log in to the Splunk Observability Cloud.
- Navigate to the Synthetics application.
- Locate the specific synthetic test related to the alert.
- Open the run results for the failed run to view the screenshot.
3. The 30-minute expiration applies only to the email link and not to the screenshot itself.