Forward the data via a WMI query to splunk , define that in wmi.conf where you mention the query and interval to check the services.
From the index you can take out the service name and status of the service. When its stopped it will alert you. It should be an realtime alert or an alert which rolls over a timeperiod. Thanks
