To add to MuS's answer, which probably has the right technique;
If you can't identify events by some string to use nullQueue consistently and easily, ... Wait, MuS, you'll probably know this better than me, but can you possibly do it on a match of time strings? As per your link to the docs, yiou could just set your REGEX to something that will match hours 18-23 and 0-5. (Possibly more easily done in two separate stanzas). You'll have to be careful, and you'll have to have very consistently identifiable timestamps, but I think this might be the way to do it if this is possible.
Beyond that, here are some other options and comments that I came up:
Any technique that stops/starts/changes the local forwarder seems like it won't work unless you do at least some local file manipulation. As MuS says, something like "erasing" the log4 file could do it if that were possible in a reasonable timeframe, so your process would be to stop the UF while the process runs for an hour, clear out the file then restart the UF. That will interrupt the other file inputs for the duration, but they'll catch up.
Along that same thread but with less interruption to the other files, you could stop the forwarder, change the config to ignore file 4 and restart. At the end of the period, you could then "erase" file 4, fix the config back and restart the forwarder. You still have to erase or remove file 4 or else the forwarder will just grab it all anyway. You could just rename it so it no longer matches the inputs before your last restart.
For the nullQueue side, same sort of technique as the first may work. At the beginning of your nullQueue period you could stop the forwarder, copy a config into place that does the nullQueue on file4's inputs, then start it back up. At the end, reverse the process. That way you would have a nearly uninterrupted ingest of files1-3 (and even file4), but the period you don't want would have file 4's contents being sent to the big bit bucket in the sky. This does mean you have another Splunk instance of some sort restarting twice a day, possibly interrupting something else.
Let us know if any of these help, or if one sounds particularly wonderful but you need a little help implementing it!
