OK I have some more information: As stated before a large file downloaded onto a test computer was not being reported in real time. However, once I canceled the download, then the data suddenly showed up (39,000 packets and 49,000 kb came in to the log all at once!)
But since my goal is to be able to see who is downloading a large file and taking up the bandwidth AT THE TIME ITS HAPPENING, this doesn't help me. How can I be able to monitor bandwidth usage for a large active download somewhere on the LAN?
I guess you should configure export timeout on your router as described here: NetFlow graphs showing more traffic than supported on T1 circuit
e.g. ip flow cache timeout active 1 for Cisco
That worked perfectly, thank you.