How to get last splunk admin credential date changed

[bapun18]

I want to get the date when the Splunk admin credential got changed, is there any way to get it?

[marnall]

Unfortunately there is no such information field in the REST API for users, and the timestamp of the passwd file is updated when any user is changed.

The best option I could find is to search the _audit index for the "change_own_password" or "password change" actions. Hopefully the last password change of the admin account occurred during your data retention period for this index.

index=_audit user=admin action=*password*