When you're using "<" in a search command within an XML document, that tag character is interpreted as part of the XML data rather than as part of the search command. To specify that this tag is not referring to the XML structure, use the special escaping sequence <![CDATA[
and its corresponding end sequence ]]>
.
See this question and corresponding for more details: http://splunk-base.splunk.com/answers/30157/inputlookup-in-view-with-rex