Dashboards & Visualizations

Has anybody parsed HL7 version 3 records (XML)?

gregbo
Communicator

I have some HL7 Version 3 records (XML) that I want to parse, but I'm having trouble figuring out how to do it. Some of the information is in a table format inside the record sort of like this (taken from a sample file):

            <component>
                <section>
                    <templateId root="2.16.840.1.113883.10.20.22.2.10"/>
                    <!--  **** Plan of Care section template  **** -->
                    <code code="18776-5" codeSystem="2.16.840.1.113883.6.1" codeSystemName="LOINC" displayName="Treatment plan"/>
                    <title>Plan of Care</title>
                    <text>
                        <table border="1" width="100%">
                            <thead>
                                <tr>
                                    <th>Planned Activity</th>
                                    <th>Planned Date</th>
                                </tr>
                            </thead>
                            <tbody>
                                <tr>
                                    <td>Colonoscopy</td>
                                    <td>April 21, 2000</td>
                                </tr>
                            </tbody>
                        </table>
                    </text>

I'd like to get the Plan of Care info and display it. Any way to do that?
I've tried using xpath, but it seems to not work at all.

0 Karma

gregbo
Communicator

I found the problem I was having with xpath...turns out that one of the items in the header was preventing xpath from working;

<ClinicalDocument xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:hl7-org:v3 http://xreg2.nist.gov:8080/hitspValidation/schema/cdar2c32/infrastructure/cda/C32_CDA.xsd"; xmlns="urn:hl7-org:v3" xmlns:mif="urn:hl7-org:v3/mif">

The next to last item (xmlns="urn:hl7-org:v3") caused the problem. If I take that out, xpath works as advertised.

0 Karma

woodcock
Esteemed Legend

This fakes your data:

|makeresults|eval _raw="
<component>
   <section>
      <templateId root=\"2.16.840.1.113883.10.20.22.2.10\"/>
      <!--  **** Plan of Care section template  **** -->
      <code code=\"18776-5\" codeSystem=\"2.16.840.1.113883.6.1\" codeSystemName=\"LOINC\" displayName=\"Treatment plan\"/>
      <title>Plan of Care</title>
      <text>
         <table border=\"1\" width=\"100%\">
            <thead>
               <tr>
                  <th>Planned Activity</th>
                  <th>Planned Date</th>
               </tr>
            </thead>
            <tbody>
               <tr>
                  <td>Colonoscopy</td>
                  <td>April 21, 2000</td>
               </tr>
            </tbody>
         </table>
      </text>
   </section>
</component>"
| fields _time _raw

This is your solution:

| streamstats count AS _serial
| xpath "//component/section/text/table/thead/tr" outfield=thead
| xpath "//component/section/text/table/tbody/tr" outfield=tbody
| rex max_match=0 field=thead "(?ms)<th>(?<kvp_keys>[^\r\n]+)</th>"
| rex max_match=0 field=tbody "(?ms)<td>(?<kvp_values>[^\r\n]+)</td>"
| eval KVP=mvzip(kvp_keys, kvp_values, ":=:")
| fields _time KVP _serial
| mvexpand KVP
| rex field=KVP "^(?<kvp_key>.*):=:(?<kvp_value>.*)$"
| eval {kvp_key}=kvp_value
| fields - KVP _raw kvp_key kvp_value
| stats first(_time) AS _time values(*) AS * BY _serial
0 Karma

woodcock
Esteemed Legend

Using xpath is the way to go, I would start by stripping off layers and retrying. Also, you can extract fields from it on the way in using INDEXED_EXTRACTIONS=XML on the forwarder's props.conf, which I would definitely try.

0 Karma

meenu_2017
Engager

Is INDEXED_EXTRACTIONS=XML setting still valid? I got an error for this setting in 7.0

0 Karma

gregbo
Communicator

I have tried those things, and I'm getting the same results. xpath seems to be failing silently, I haven't seen anything in the logs (even at DEBBUG).

0 Karma

gregbo
Communicator

xpath is simply not working, even on tiny test files. Does anyone have any pointers for me, on where i can look for config issues or something?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...