I don't quite understand your question do you just want to rename the field INT (probably not)? Then you can do the following:
index=ABC "duplex"| top hostname INT | rename INT as INTERFACE
If the INT/INTERFACE field ist missing then the field extractions for that source/sourcetype are not configured yet.
-> I recommend you read the documentation about transforms & props
If the filed already exists but is called INTERFACE instead of INT you can create the following ( maybe after reading about props.conf) stanza in props.conf
$SPLUNK_HOME/etc/system/local/props.conf
[mySourceType]
FIELDALIAS-extract_ip = INTERFACE AS INT
If you need more help let me know
Chris
... View more