I have a long xml file with many < host id> stanzas. Each one of these stanza has an < ip> value associated and many < vulnerability id> stanzas. Each one of these has a set of 3 values made of < score> < port> < protocol>
Can you post how your events are broken? Are they multi-line? Next do you have the xml field extractions on?
Making an assumption that you have events being grouped by xml blocks, and you have your events are broken by the "host_id" block. I'm also assuming that you have extractions on your fields. (if you're not check out this post: Xml Inputs)
if you're data isn't broken by the host_id block, your search can get a lot more complex, so please let me know how your events are being broken. If your events are broken on every line, you may need to use either the transaction command or the stats command to combine your events, and then use a post processing search.