If you look at what is actually stored in the summary index, you will get some hints about what will/won't work. I don't know that I understand the question properly, but here is an idea
Use the following for the "populating search" or "summary query"
host=*foo* status=200 authenticate POST email | sistats count by email
Then see what you get. And I might have more suggestions if I really knew what you want - the email with the most events from the last 24 hours? Is "email" actually the name of a field? I assume so in the search above...