How can we get the logs generated only in an indicated period?

[xiyangyang]

we need take the logs generated from 00:00 ~8:00 under one folder (for example: folder /a/).
Under /a/, there are several log files. For example: a.log, b.log.
a.log is generated from 00:00~8:00, but b.log is not.
We set input.conf as follow and start the log acquasition from 0:00 and stop it at 8:00 everyday:
　　　　　　[monitor:///a/*]
　　　　　　disabled = false
　　　　　　sourcetype = xxxxx
　　　　　　index = ssss
　　　　　　followTail = 1
　　　　　　ignoreOlderThan = 1d
Under this settings, we got both a.log and b.log. however, b.log is not the target,

How can we get the log which generated in the correct period only?
We cannot use white list or black list, because there are a lot of logs.

[esix_splunk]

If the names of the logs are truly random, and cant apply a whitelist / blacklist, then you really cant do much except the monitor the whole directory.

Whitelisting the filenames would be the best method to approach this.

If you are not looking at realtime monitoring of these files, then you might be better to work on a scripted solution that will move only the desired logs to a separate folder and have splunk monitor that directory.. That does require some scripting outside of Splunk though...

Is this a custom app?

[xiyangyang]

we don't know exactly the name fo logs. The logs generate every day.

[esix_splunk]

If you know which logs these are, you can create an input for the specific files. That is probably the best way to accomplish this..

---

[monitor:///a/a.log]
sourcetype = alog
index = ssss
followTail = 1
ignoreOlderThan = 1d

[monitor:///a/b.log]
sourcetype = blog
index = ssss
followTail = 1
ignoreOlderThan = 1d

[monitor:///a/c.log]
sourcetype = clog
index = ssss
followTail = 1
ignoreOlderThan = 1d

You can also leave in the monitor glob for the whole directory, after these specific inputs...