This is the code that solved my needs for a list over users that have got the Password Last Change timestamp updated without changing the password.
Found a way to get the information in a super easy way. On my single instance Splunk the search runs for 42 sec on a 60 day search
index=winevents Account_Domain="YourDomain" ((EventCode=4738 Password_Last_Set!="<never>") OR EventCode=4723)
| convert timeformat="%Y.%m.%d" ctime(_time) AS timestamp
| eval Message=split(Message,".")
| eval Short_Message=mvindex(Message,0)
| eval Admin=mvindex(Account_Name,0)
| eval User=mvindex(Account_Name,1)
| transaction User maxspan=7d
| search EventCode=4738 EventCode!=4723 Admin=_* Password_Last_Set!="-"
| table timestamp EventCode Short_Message Admin User Keywords Password_Last_Set
... View more