If I recall correctly, the Cisco commands "write memory" and "copy running-config..." always indent child nodes by one space. I never wrote anything that depended on the indentation, but it certainly looked consistent enough to use in parsing the files. YMMV.
For example, this is a fragment of a lab router config for a 7200:
no ip address
encapsulation dot1Q 1 native
ipv6 address xxxx:1::3/48
ipv6 traffic-filter lab-only in
ipv6 ospf 1 area 0
line con 0
line aux 0
So "no ip address" and "duplex full" are child nodes of "interface FastEthernet1/0" because they are indented farther to the right.
There are a few cases where second-level child nodes exist and are indented by two spaces, but I don't have any examples handy. Oh, and by the way, don't try to use the exclamation points in parsing; they are not nearly as consistent as the spacing.