Deploy or update a saved search used for an alert on azure OMS – Error “Please validate the JSON payload.”

Just a quick post to hopefully help other people with this error..

Long story short, we had a VSTS pipeline and code made by a guy few months ago, it was supposed to work. I did few changes and I had problems with the pipeline, fixed it and I finally was able to deploy. After few days of work it wasn’t working anymore.

I got a bunch of weird error like I wasn’t able to update the saved search, so I deleted them by hand which seems to fix this problem. But after that I got this weird error message which don’t say a lot of details about what is failing.

2019-06-08T01:41:44.9587130Z ##[error]At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details.
2019-06-08T01:41:44.9596749Z ##[error]Details:
2019-06-08T01:41:44.9597162Z ##[error]BadRequest: {
"error": {
"code": "BadRequest",
"message": "Please validate the JSON payload."
}
} undefined

So as advised by one of my coworker I stopped using VSTS and try to deploy using powershell. It wasn’t working better, but yeah at least I got more details about the failing ressources.

Resource Microsoft.OperationalInsights/workspaces/savedSearches/schedules/actions XXXXXXXXXX

So at least now I knew what resources was concerned by this problem… After a lot of try I finally find out the query the guy wrote on few alerts wasn’t working. At least, it is not working anymore… So I removed the “| distinct RawData, Computer” and my deployment started working again.

Now the weird thing is it did work for a few times with this code.. At one time I fucked up the name of the alarm in prod vs nonprod and it looks like the problem started around this time but even after deleting all the saved search/solutions it was still failling…

So anyway it is working now, I hope someone will find this usefull and save them few hours of wasted time!