There's a lot of different ways to approach this - are you planning on creating an alert from a scheduled search running every 15m? Do you want to just create a dashboard with uncommon or recent errors? What do you want to tell the consumer of the search result about the error - what host it came from? The error itself? Any other info?
For now we can choose a simple case. Let's assume your data's sourcetype is sagineshmk_logs, and the error is in a field named error_name. You could do a search like the following:
sourcetype=sagineshmk_logs earliest=-30d@d | stats count as error_count, max(_time) as _time by error_name | where error_count=1
For a production environment, though, I might not want to run the above search every 15m and constantly look over 30 days of data. In that case I may split the search into two separate pieces - one search to compile a list of unique errors in the last 30 days (e.g. run that daily), then a second search that only looks at the past 15 minute's worth of errors and compares it to my daily unique error list.
