Windows Service Monitoring Warning Only when Stopped

Hello All

I continue to struggle with Windows Service Monitoring. My Service filter looks like below

I want to raise only warning alert when a service is stopped instead of default critical alert. I am not able to figure out where I make the change

filter=start_type = ‘auto’ and crit=none and warn=state=‘stopped’ and name not in (‘VSS’ , ‘vds’ , ‘gupdate’ , ‘RemoteRegistry’ , ‘wuauserv’ , ‘CDPSvc’ , ‘sppsvc’, ‘vRASoftwareAgentBootstrap’ , ‘tiledatamodelsvc’, ‘WbioSrvc’)

It says wrong filter and going in Unknown state.


If I remove warn=state=‘stopped’ and also crit=none to just state=‘stopped’ it works fine - just raise critical alert as expected. But I want to make it warning instead of critical