How to extract rpc_completed extended event info, ex: plan_handle?

Hi experts,

    I use this link - sql_statement_completed as an example ( http://blogs.msdn.com/b/saponsqlserver/archive/2010/06/16/analyzing-statements-with-extended-events-extended-events-part-ii.aspx ) to extract rpc_completed info but I can't extract plan_handle info nicely. Please help.

--- create extended event

IF EXISTS(SELECT * FROM sys.server_event_sessions WHERE name='RPC_Expensive_Queries')
    DROP EVENT SESSION [RPC_Expensive_Queries] ON SERVER;
GO

CREATE EVENT SESSION [RPC_Expensive_Queries] ON SERVER
    ADD EVENT sqlserver.rpc_completed(
         ACTION (sqlserver.database_id, 
                 sqlserver.plan_handle, 
                 sqlserver.session_id, 
                 sqlserver.sql_text)
    WHERE cpu_time > 100000000 /*total ms of CPU time, eight 0, 00000000*/
       OR duration > 100000000 /* eight 0*/
       OR logical_reads > 10000000 /* seven 0 */
       OR physical_reads > 1000000 /* six 0 */
       OR writes > 100000 ) /*five 0 */
    ADD TARGET package0.ring_buffer(SET max_memory=2048),
    ADD TARGET package0.asynchronous_bucketizer(
        SET filtering_event_name='sqlserver.rpc_completed', 
            source='sqlserver.sql_text'),
    ADD TARGET package0.asynchronous_file_target
        (SET FILENAME = N'C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\RPC_Expensive_Queries.xel', 
        METADATAFILE = N'C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\RPC_Expensive_Queries.xem')
WITH (MAX_MEMORY = 4096KB, 
      EVENT_RETENTION_MODE = ALLOW_SINGLE_EVENT_LOSS, 
      MAX_DISPATCH_LATENCY = 10 SECONDS, 
      MAX_EVENT_SIZE = 0KB, 
      MEMORY_PARTITION_MODE = NONE, 
      TRACK_CAUSALITY = OFF, 
      STARTUP_STATE = OFF)
GO

ALTER EVENT SESSION [RPC_Expensive_Queries] ON SERVER STATE = START
GO

--- can't get any results by this T-SQL

SELECT 
    Slots.value('(data/value)[4]', 'BIGINT') as cpu,
    Slots.value('(data/value)[5]', 'BIGINT') as duration,
    Slots.value('(data/value)[6]', 'BIGINT') as reads,
    Slots.value('(data/value)[7]', 'BIGINT') as writes,
    db_name(Slots.value('(action/value)[1]', 'BIGINT')) as database_id,
    qp.query_plan,
    Slots.value('(action/value)[3]', 'BIGINT') as session_id,
    Slots.value('(action/value)[4]', 'nvarchar(max)') as sql_text
FROM
    (SELECT CAST(target_data as xml) as Bucket 
     FROM sys.dm_xe_session_targets st join 
          sys.dm_xe_sessions s on s.address = st.event_session_address
     WHERE name = 'RPC_Expensive_Queries') AS Buckets

    CROSS APPLY Bucket.nodes ('//RingBufferTarget/event') AS XE(Slots)
    CROSS APPLY sys.dm_exec_query_plan(convert(varbinary(max),
    Slots.value('(action/value)[2]', 'nvarchar(max)'),2)) as qp
WHERE Slots.value('@name', 'varchar(4000)') = 'rpc_completed' 
ORDER BY Slots.value('(data/value)[5]', 'BIGINT') desc  -- Order by Duration

--- some info is correct but plan_handle is still wrong

SELECT
data.value (
'(/event[@name=''rpc_completed'']/@timestamp)[1]',
'DATETIME') AS [Time],
data.value ('(/event/data[@name=''cpu_time'']/value)[1]', 'BIGINT') AS [CPU (ms)],
data.value ('(/event/data[@name=''duration'']/value)[1]', 'BIGINT') AS [duration (ms)],
--CONVERT (FLOAT, data.value (
--'(/event/data[@name=''cpu_time'']/value)[1]', 'BIGINT')) / 1000000 AS [CPU (s)],
--CONVERT (FLOAT, data.value (
--'(/event/data[@name=''duration'']/value)[1]', 'BIGINT')) / 1000000 AS [Duration (s)],
        data.value('(/event/data[@name=''logical_reads'']/value)[1]','bigint') LogicalReads,
        data.value('(/event/data[@name=''physical_reads'']/value)[1]','bigint') PhysicalReads,
        data.value('(./data[@name="writes"]/value)[1]', 'bigint') as writes,
data.value ('(/event/action[@name=''sql_text'']/value)[1]','VARCHAR(MAX)') AS [SQL Text],
        data.value ('(/event/data[@name=''statement'']/value)[1]','VARCHAR(MAX)') AS [Statement],
CAST(data.value('(event/action[@name="plan_handle"]/value)[1]', 'varchar(max)') AS XML) as plan_handle
FROM 
(SELECT CONVERT (XML, event_data) AS data
FROM sys.fn_xe_file_target_read_file
('C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\RPC_Expensive_Queries*.xel',
'C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\RPC_Expensive_Queries*.xem', null, null)
) entries  
ORDER BY [Time] DESC;
GO