as an off-hand tip I would say you need to make sure the event codes for successful updates (e.g.1118, 2401 ("The update was successful")) are not filtered so a custom query could look like this:
display number of computers at the given timepoint (or interval) for which the event table contains such events. The total number of computers minus number of computers with this event could give computers that not updated successfully that interval. Hope I did get it right :-)
For query use client events not threat events.
I'm not sure about the exact event codes for successful updates and was not able to look up a KB article (although there is one) to assist me. Perhaps you'll have more luck in finding that.