To clarify, yes the _audit index is for storing audit events related to Splunk itself. Most apps have a way of auditing activity, and that is Splunk's. It won't contain audit data for the rest of your infrastructure/apps.
The PCI app, I believe, is designed to help you meet PCI Compliance (think credit card payments). So I doubt it will help you audit the rest of your infrastructure (but I don't have it installed so can't speak to it much beyond that). From the description of the app
The Splunk App for PCI Compliance (for Splunk Enterprise) is a Splunk developed and supported App designed to help organizations meet PCI DSS requirements. It reviews and measures the effectiveness and status of PCI compliance technical controls in real time. It can also identify and prioritize any control areas that may need to be addressed and let you quickly address any auditor report or data request.
For your use case, it might help to define what you mean by "audit all privileged users". Audit their logins? Audit their actions? Password Changes? Etc? Once you know what you're looking to audit, determine where that audit data exists - app logs, win event logs, databases etc. Then ingest those data sources into Splunk. Once the data is in Splunk, then you can run searches across that data to help audit whatever events you identified in step 1.
I know that's a very generic answer, but it was a pretty broad question too. Hope it helps a little at least.
