If that's all the config you have, and not any log discriminator config, you should be getting these logs to splunk.
If you enter and exit the config mode, you should get another lvl5/notification type syslog (SYS-5-CONFIG_I), do you get that to splunk.
I'm assuming you already have the "login on-failure log" command since you're seeing the logs in the buffer.
Using the same config, I've verified that a switch that I have sends the sec_login-5-login_success command to the syslog server.
Maybe a packet capture between splunk and switch to verify what the switch sends to splunk, or is there something on splunks side to verify everything from the switch, not just what splunk is able to parse?
You could also test increasing the logging trap to warning or debugging (won't matter that much for switch anyway), to see if that has any effect.
