Deploy or update a saved search used for an alert on azure OMS – Error “Please validate the JSON payload.”

Just a quick post to hopefully help other people with this error..

Long story short, we had a VSTS pipeline and code made by a guy few months ago, it was supposed to work. I did few changes and I had problems with the pipeline, fixed it and I finally was able to deploy. After few days of work it wasn’t working anymore.

I got a bunch of weird error like I wasn’t able to update the saved search, so I deleted them by hand which seems to fix this problem. But after that I got this weird error message which don’t say a lot of details about what is failing.

2019-06-08T01:41:44.9587130Z ##[error]At least one resource deployment operation failed. Please list deployment operations for details. Please see for usage details.
2019-06-08T01:41:44.9596749Z ##[error]Details:
2019-06-08T01:41:44.9597162Z ##[error]BadRequest: {
"error": {
"code": "BadRequest",
"message": "Please validate the JSON payload."
} undefined

So as advised by one of my coworker I stopped using VSTS and try to deploy using powershell. It wasn’t working better, but yeah at least I got more details about the failing ressources.

Resource Microsoft.OperationalInsights/workspaces/savedSearches/schedules/actions XXXXXXXXXX

So at least now I knew what resources was concerned by this problem… After a lot of try I finally find out the query the guy wrote on few alerts wasn’t working. At least, it is not working anymore… So I removed the “| distinct RawData, Computer” and my deployment started working again.

Now the weird thing is it did work for a few times with this code.. At one time I fucked up the name of the alarm in prod vs nonprod and it looks like the problem started around this time but even after deleting all the saved search/solutions it was still failling…

So anyway it is working now, I hope someone will find this usefull and save them few hours of wasted time!




Author: Arsenick

Hi all! I'm a 27 years old guy from Quebec city, Canada. I've been playing with Linux since 1998 and start to earn my life using Linux and FOSS around 2005. Since then I've earned few certification and courses including CLP10 (Certified Linux Professional from Novell), RHCE (RedHat Certified Engineer) and JBOSS Administration course. I'm a Linux sys admin and I'm working here in Quebec city for a small company who are RedHat Advanced partner since few years. So I'm trying to always keep me updated on new technology and new RedHat product. The best way I've found to do it is to use and contribute to the Fedora Community. So I've joined the community in mid 2009 as a Fedora Ambassadors, I still learning how everything work in a opensource community, but I really liked what I saw at the 2009 FUDCON in Toronto.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.