If I recall correctly, the Cisco commands "write memory" and "copy running-config..." always indent child nodes by one space. I never wrote anything that depended on the indentation, but it certainly looked consistent enough to use in parsing the files. YMMV.
For example, this is a fragment of a lab router config for a 7200:
interface FastEthernet1/0
no ip address
duplex full
!
interface FastEthernet1/0.1
encapsulation dot1Q 1 native
ipv6 address xxxx:1::3/48
ipv6 traffic-filter lab-only in
ipv6 ospf 1 area 0
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
stopbits 1
So "no ip address" and "duplex full" are child nodes of "interface FastEthernet1/0" because they are indented farther to the right.
There are a few cases where second-level child nodes exist and are indented by two spaces, but I don't have any examples handy. Oh, and by the way, don't try to use the exclamation points in parsing; they are not nearly as consistent as the spacing.
