Look for open port 631

xpquery jwing-ipp-scan '//address[following-sibling::ports/port[@portid = "631"]/state/@state = "open"]/@addr' | perl -ple 's/(128.95)/\n$1/g'

Microsoft systems with port 135 open, get addresses

xpquery scan.xml '/nmaprun/host/address[following-sibling::os/osclass/@vendor = "Microsoft" and following-sibling::ports/port[@portid = "135"]/state/@state = "open"]/@addr' | perl -ple 's/(?<=\d)(128\.)/\n$1/g'