Save it as an alert. That should do the trick for you, whenever your alert detects if a service isn't running.
index="index-name" source=ps host="hostname*" process="process_name"
| dedup host process
| join host [search index="index-name" source=ps host="hostname*" process="process_name"
| stats latest(host) latest(_time) by host |eval lastSeen='latest(_time)'|fields host lastSeen]
|eval status=if(lastSeen<(_time - 300), "not running","running")
|table host status process
| search status = "not running"
If it doesn't help, you can save the specific condition status = "not running" in aler settings -> Trigger Conditions -> Trigger alert when and from the drop down, select custom and define the condition there.