Query for Window Services State when one service is running and other one is stopped

HiRuheena 

I believe the example query on the blog post is the following:

Event
| where EventLog == 'System' and EventID == 7036 and Source == 'Service Control Manager'
| parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>' *
| sort by TimeGenerated desc
| project Computer, Windows_Service_Name, Windows_Service_State, TimeGenerated

I currently do not have env to test the data but in order to do what you want to do you have to create two separate queries  and join or unify the results. I assume that by your request it is unification rather join. The query will be the following:

let ServiceARunning = Event
| where EventLog == 'System' and EventID == 7036 and Source == 'Service Control Manager'
| parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>' *
| where Windows_Service_Name == 'Service A' and  Windows_Service_State == 'running';
Event
| where EventLog == 'System' and EventID == 7036 and Source == 'Service Control Manager'
| parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>' *
| where Windows_Service_Name == 'Service B' and  Windows_Service_State == 'stopped' | union ServiceARunning
| sort by TimeGenerated desc
| project Computer, Windows_Service_Name, Windows_Service_State, TimeGenerated

Additionally if you have Change Tracking solution enabled you might want to use that as it has as low as 30 seconds of gathering data for stopped/started services.

The example would be:

let SvcAStopped = ConfigurationChange
| where ConfigChangeType == "WindowsServices" and SvcDisplayName == 'Windows Error Reporting Service' and SvcState == 'Stopped';
ConfigurationChange 
| where ConfigChangeType == "WindowsServices" and SvcDisplayName == 'Network Setup Service' and SvcState == 'Running' 
| union SvcAStopped
| sort by TimeGenerated desc
| project Computer, SvcDisplayName, SvcState, TimeGenerated

As I have said we are doing union in both queries - basically just merging the two tables without having to match specific records.

I hope this answers your question.