Is the text in a field? If so an eval expression would be one solution
startswith=eval(thefieldname=="Sophos Anti-Virus service entered the stopped")
If there's further text in the field following this phrase you could use a wildcard at the end.
"Sophos Anti-Virus service entered the stopped*"
If it's not a pre-defined (persistent) field you could use rex or erex to create a transient field before the transaction command and use that in the startswith/ eval.