Format for the string on the RHS is in the form "Class://SystemObject/Software Installation/Symantec NetBackup Client"
server property is always going to be an “instance of” that property class, or it will be empty, because that is the link you have already set up. I think you just want to do this:
"??TARGET.SOFTWARE_INSTALLATION_SYMANTEC_NETBACKUP_CLIENT?? is not equal to “” (empty quotes)
Your discovery criteria would then pop on severs that have that property populated (by transitive math, with an instance of the linked property class)
That not the case. If the property is not set the instance is ignored. I've checked the functionality it works as given. null (or whatever BBSA internal uses) is not an instance of that class it seems. "" doesn't work as expected - from memory I think BBSA RCP wouldn't accept the input.