But ARP seem to take an ip address as input and give the corresponding MAC address.
That is correct (for IPv4). ARP can also be used to check if an IP address is already in use (for DHCP, Zeroconf, etc).
There are several methods for finding other hosts:
The first is that the peer IP or DNS name is configured somewhere on a host. The DNS name requires DNS resolution (A record) to find the IP address. DNS server and (default) gateway IP addresses are often configured by the DHCP protocol.
The second is via broadcast (used for DHCP discovery, Bonjour, UPnP, and many other protocols), so a peer either regularly announces its presence or another peer can broadcast to get a reply. Of course, multicast can also be used instead of a (general) broadcast.
Both, broadcast and multicast, usually only work within the scope of the broadcast domain ie. the local link-layer segment, often identical with the IP subnet.
There's also a (crude) third method: try and error. A host may simply "sweep" a subnet, trying to connect to each possible IP address and see what turns up.
Finally, there are link-layer discovery protocols like Cisco's CDP or IEEE's LLDP that a node can use to announce its presence and capabilities to its directly connected neighbors. This method is very common with (business-grade) network devices but rarely used elsewhere.