I can use the API to set this:
curl -k -u admin:changeme https://localhost:8089/services/authentication/users/test_user -d force-change-pass=true
etc/passwd:
:test_user:$6$7d9TeVeVS./Z0ojt$jAlgxrZaaAAaAaAqY11Nr1uP0q4/utf1VXsL5sIrtj7CSPRAoikExiyL.SGAy/8bfsPK7/:::user:::force_change_pass
but on the command line there is no luck:
*splunk edit user test_user -force_change_pass true -auth admin:changeme *
In handler 'users': Argument "force_change_pass" is not supported by this handler.
You can use Splunk's command line to do this by invoking an _internal call ...
$SPLUNK_HOME/bin/splunk _interncal call /authentication/users/test_user -post:force-change-pass "true"
Do like this
splunk edit user test_user -force-change-pass true -auth admin:changeme