You're really looking to keep 'state' and that's somewhat outside the scope.
There are two options that almost meet your needs - first, create a filter using 'Flags/Counters' and select time interval. This will fire once the first time the log is matched then again once the time interval(15 minutes) has passed. The first alert would be the 'warning' to watch for the second alert. It is possible that those would be the only two matches and nothing occurred in the preceding 15 minutes. The second option is the Threshold counter. You could set it to 2 or more matches in a 900 second period.
Neither is perfect but could meet the requirement.
It could also be scripted with data dictionaries to store the first event and timing data.