<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Has anybody parsed HL7 version 3 records (XML)? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359588#M23424</link>
    <description>&lt;P&gt;xpath is simply not working, even on tiny test files.  Does anyone have any pointers for me, on where i can look for config issues or something?&lt;/P&gt;</description>
    <pubDate>Mon, 20 Mar 2017 16:44:50 GMT</pubDate>
    <dc:creator>gregbo</dc:creator>
    <dc:date>2017-03-20T16:44:50Z</dc:date>
    <item>
      <title>Has anybody parsed HL7 version 3 records (XML)?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359586#M23422</link>
      <description>&lt;P&gt;I have some HL7 Version 3 records (XML) that I want to parse, but I'm having trouble figuring out how to do it.  Some of the information is in a table format inside the record sort of like this (taken from a sample file):&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;            &amp;lt;component&amp;gt;
                &amp;lt;section&amp;gt;
                    &amp;lt;templateId root="2.16.840.1.113883.10.20.22.2.10"/&amp;gt;
                    &amp;lt;!--  **** Plan of Care section template  **** --&amp;gt;
                    &amp;lt;code code="18776-5" codeSystem="2.16.840.1.113883.6.1" codeSystemName="LOINC" displayName="Treatment plan"/&amp;gt;
                    &amp;lt;title&amp;gt;Plan of Care&amp;lt;/title&amp;gt;
                    &amp;lt;text&amp;gt;
                        &amp;lt;table border="1" width="100%"&amp;gt;
                            &amp;lt;thead&amp;gt;
                                &amp;lt;tr&amp;gt;
                                    &amp;lt;th&amp;gt;Planned Activity&amp;lt;/th&amp;gt;
                                    &amp;lt;th&amp;gt;Planned Date&amp;lt;/th&amp;gt;
                                &amp;lt;/tr&amp;gt;
                            &amp;lt;/thead&amp;gt;
                            &amp;lt;tbody&amp;gt;
                                &amp;lt;tr&amp;gt;
                                    &amp;lt;td&amp;gt;Colonoscopy&amp;lt;/td&amp;gt;
                                    &amp;lt;td&amp;gt;April 21, 2000&amp;lt;/td&amp;gt;
                                &amp;lt;/tr&amp;gt;
                            &amp;lt;/tbody&amp;gt;
                        &amp;lt;/table&amp;gt;
                    &amp;lt;/text&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I'd like to get the Plan of Care info and display it.  Any way to do that?&lt;BR /&gt;
I've tried using xpath, but it seems to not work at all.&lt;/P&gt;</description>
      <pubDate>Fri, 17 Mar 2017 13:27:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359586#M23422</guid>
      <dc:creator>gregbo</dc:creator>
      <dc:date>2017-03-17T13:27:31Z</dc:date>
    </item>
    <item>
      <title>Re: Has anybody parsed HL7 version 3 records (XML)?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359587#M23423</link>
      <description>&lt;P&gt;Using &lt;CODE&gt;xpath&lt;/CODE&gt; is the way to go, I would start by stripping off layers and retrying.  Also, you can extract fields from it on the way in using &lt;CODE&gt;INDEXED_EXTRACTIONS=XML&lt;/CODE&gt; on the forwarder's props.conf, which I would definitely try.&lt;/P&gt;</description>
      <pubDate>Fri, 17 Mar 2017 14:18:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359587#M23423</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2017-03-17T14:18:37Z</dc:date>
    </item>
    <item>
      <title>Re: Has anybody parsed HL7 version 3 records (XML)?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359588#M23424</link>
      <description>&lt;P&gt;xpath is simply not working, even on tiny test files.  Does anyone have any pointers for me, on where i can look for config issues or something?&lt;/P&gt;</description>
      <pubDate>Mon, 20 Mar 2017 16:44:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359588#M23424</guid>
      <dc:creator>gregbo</dc:creator>
      <dc:date>2017-03-20T16:44:50Z</dc:date>
    </item>
    <item>
      <title>Re: Has anybody parsed HL7 version 3 records (XML)?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359589#M23425</link>
      <description>&lt;P&gt;This fakes your data:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;|makeresults|eval _raw="
&amp;lt;component&amp;gt;
   &amp;lt;section&amp;gt;
      &amp;lt;templateId root=\"2.16.840.1.113883.10.20.22.2.10\"/&amp;gt;
      &amp;lt;!--  **** Plan of Care section template  **** --&amp;gt;
      &amp;lt;code code=\"18776-5\" codeSystem=\"2.16.840.1.113883.6.1\" codeSystemName=\"LOINC\" displayName=\"Treatment plan\"/&amp;gt;
      &amp;lt;title&amp;gt;Plan of Care&amp;lt;/title&amp;gt;
      &amp;lt;text&amp;gt;
         &amp;lt;table border=\"1\" width=\"100%\"&amp;gt;
            &amp;lt;thead&amp;gt;
               &amp;lt;tr&amp;gt;
                  &amp;lt;th&amp;gt;Planned Activity&amp;lt;/th&amp;gt;
                  &amp;lt;th&amp;gt;Planned Date&amp;lt;/th&amp;gt;
               &amp;lt;/tr&amp;gt;
            &amp;lt;/thead&amp;gt;
            &amp;lt;tbody&amp;gt;
               &amp;lt;tr&amp;gt;
                  &amp;lt;td&amp;gt;Colonoscopy&amp;lt;/td&amp;gt;
                  &amp;lt;td&amp;gt;April 21, 2000&amp;lt;/td&amp;gt;
               &amp;lt;/tr&amp;gt;
            &amp;lt;/tbody&amp;gt;
         &amp;lt;/table&amp;gt;
      &amp;lt;/text&amp;gt;
   &amp;lt;/section&amp;gt;
&amp;lt;/component&amp;gt;"
| fields _time _raw
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This is your solution:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| streamstats count AS _serial
| xpath "//component/section/text/table/thead/tr" outfield=thead
| xpath "//component/section/text/table/tbody/tr" outfield=tbody
| rex max_match=0 field=thead "(?ms)&amp;lt;th&amp;gt;(?&amp;lt;kvp_keys&amp;gt;[^\r\n]+)&amp;lt;/th&amp;gt;"
| rex max_match=0 field=tbody "(?ms)&amp;lt;td&amp;gt;(?&amp;lt;kvp_values&amp;gt;[^\r\n]+)&amp;lt;/td&amp;gt;"
| eval KVP=mvzip(kvp_keys, kvp_values, ":=:")
| fields _time KVP _serial
| mvexpand KVP
| rex field=KVP "^(?&amp;lt;kvp_key&amp;gt;.*):=:(?&amp;lt;kvp_value&amp;gt;.*)$"
| eval {kvp_key}=kvp_value
| fields - KVP _raw kvp_key kvp_value
| stats first(_time) AS _time values(*) AS * BY _serial
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 21 Mar 2017 01:12:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359589#M23425</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2017-03-21T01:12:33Z</dc:date>
    </item>
    <item>
      <title>Re: Has anybody parsed HL7 version 3 records (XML)?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359590#M23426</link>
      <description>&lt;P&gt;I have tried those things, and I'm getting the same results.  xpath seems to be failing silently, I haven't seen anything in the logs (even at DEBBUG).&lt;/P&gt;</description>
      <pubDate>Tue, 21 Mar 2017 09:34:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359590#M23426</guid>
      <dc:creator>gregbo</dc:creator>
      <dc:date>2017-03-21T09:34:04Z</dc:date>
    </item>
    <item>
      <title>Re: Has anybody parsed HL7 version 3 records (XML)?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359591#M23427</link>
      <description>&lt;P&gt;I found the problem I was having with xpath...turns out that one of the items in the header was preventing xpath from working;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;ClinicalDocument xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:hl7-org:v3 &lt;A href="http://xreg2.nist.gov:8080/hitspValidation/schema/cdar2c32/infrastructure/cda/C32_CDA.xsd&amp;quot;" target="test_blank"&gt;http://xreg2.nist.gov:8080/hitspValidation/schema/cdar2c32/infrastructure/cda/C32_CDA.xsd"&lt;/A&gt;; xmlns="urn:hl7-org:v3" xmlns:mif="urn:hl7-org:v3/mif"&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The next to last item (&lt;STRONG&gt;xmlns="urn:hl7-org:v3"&lt;/STRONG&gt;) caused the problem.  If I take that out, xpath works as advertised.&lt;/P&gt;</description>
      <pubDate>Tue, 21 Mar 2017 16:01:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359591#M23427</guid>
      <dc:creator>gregbo</dc:creator>
      <dc:date>2017-03-21T16:01:18Z</dc:date>
    </item>
    <item>
      <title>Re: Has anybody parsed HL7 version 3 records (XML)?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359592#M23428</link>
      <description>&lt;P&gt;Is INDEXED_EXTRACTIONS=XML setting still valid? I got an error for this setting in 7.0&lt;/P&gt;</description>
      <pubDate>Thu, 24 May 2018 18:41:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Has-anybody-parsed-HL7-version-3-records-XML/m-p/359592#M23428</guid>
      <dc:creator>meenu_2017</dc:creator>
      <dc:date>2018-05-24T18:41:16Z</dc:date>
    </item>
  </channel>
</rss>

